SoylentNews

An Anonymous Coward writes:

By Bill Toulas == May 19, 2025

Mozilla released emergency security updates [bleepingcomputer.com] to address two Firefox zero-day vulnerabilities [ghacks.net] demonstrated in the recent Pwn2Own Berlin 2025 hacking competition.

The fixes, which include the Firefox on Desktop and Android and two Extended Support Releases (ESR), came mere hours after the conclusion of Pwn2Own, on Saturday, where the second vulnerability was demonstrated.

The first flaw, tracked under CVE-2025-4918, is an out-of-bounds read/write issue in the JavaScript engine when resolving Promise objects.

The flaw was demonstrated during Day 2 of the competition by Palo Alto Networks security researchers Edouard Bochin and Tao Yan, who earned $50,000 for their discovery.

The second flaw, CVE-2025-4919, allows attackers to perform out-of-bounds reads/writes on a JavaScript object by confusing array index sizes.

It was discovered by security researcher Manfred Paul, who gained unauthorized access within the program's renderer, winning $50,000 in the process.

Although the flaws constitute significant risks for Firefox, with Mozilla rating them "critical" in its bulletins, the software vendor underlined that neither researchers could perform a sandbox escape, citing targeted strengthening on that front.

"Unlike prior years, neither participating group was able to escape our sandbox this year," explained Firefox in the announcement.

"We have verbal confirmation that this is attributed to the recent architectural improvements to our Firefox sandbox which have neutered a wide range of such attacks."

Although there are no indications that the two flaws have been exploited outside of Pwn2Own, their public demonstration could fuel real attacks soon.

To mitigate this risk, Mozilla engaged a diverse "task force" from across the globe that worked feverishly to develop fixes for the demonstrated exploits, test them, and push out security updates as soon as possible.

Firefox users are recommended to upgrade to version 138.0.4, ESR 128.10.1, or ESR 115.23.1.

Pwn2Own Berlin 2025 concluded on Saturday with over a million USD in payouts and the STAR Labs SG team winning the 'Master or Pwn' title.

Two Firefox zero-days were also demonstrated last year at Pwn2Own Vancouver 2024, with Mozilla fixing them the next day.

By Martin Brinkmann = May 18th, 2025

Two critical security issues in Firefox

Mozilla lists the two fixed security issues on the official security advisory website of the Firefox web browser. Both have a critical severity rating, which is the highest rating available.

        CVE-2025-4920: Out-of-bounds access when resolving Promise objects -- An attacker was able to perform an out-of-bounds read or write on a JavaScript Promise object.
        CVE-2025-4921: Out-of-bounds access when optimizing linear sums -- An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index sizes.

The next major release of the Firefox web browser is Firefox 139 Stable. Firefox 115.24 ESR and Firefox 128.11 ESR will also be released on the same day.

Original Submission