| Package | Affected versions | Patched versions |
|---|---|---|
| firefox | ≥ 128.1.0, < 128.8.1< 115.21.1< 136.0.4 | 128.8.1115.21.1136.0.4 |
Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a similar pattern in our IPC code. A compromised child process could cause the parent process to return an unintentionally powerful handle, leading to a sandbox escape. The original vulnerability was being exploited in the wild. *This only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability was fixed in Firefox 136.0.4, Firefox ESR 128.8.1, and Firefox ESR 115.21.1.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free