Bug 2355327 (CVE-2025-2857) - CVE-2025-2857 firefox: Firefox IPC sandbox escape on windows
Summary: CVE-2025-2857 firefox: Firefox IPC sandbox escape on windows
Keywords:
Status: NEW
Alias: CVE-2025-2857
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
unspecified
unspecified
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-03-27 14:01 UTC by OSIDB Bzimport
Modified: 2025-03-27 20:25 UTC (History)
5 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2025-03-27 14:01:14 UTC 
Following the sanbdox escape in CVE-2025-2783, various Firefox developers identified a similar pattern in our IPC code. Attackers were able to confuse the parent process into leaking handles into unpriviled child processes leading to a sandbox escape. 
The original vulnerability was being exploited in the wild. 
*This only affects Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox < 136.0.4, Firefox ESR < 128.8.1, and Firefox ESR < 115.21.1.
Note You need to log in before you can comment on or make changes to this bug.