Cross-Site Scripting Vulnerability in Mozilla Firefox and Thunderbird

CVE-2025-0240

Summary

A potential security vulnerability exists in Mozilla Firefox and Thunderbird where parsing a JavaScript module as JSON may cause cross-compartment access. This flaw can lead to a use-after-free condition, creating risks for users of affected versions. Specifically, versions of Firefox prior to 134, Firefox ESR prior to 128.6, and Thunderbird versions prior to 134 and 128.6 are vulnerable. Users are urged to update their software promptly to mitigate potential risks.

References