Critical · published October 14, 2025
🚨 A compromised web process can trigger out-of-bounds reads and writes, making this a critical vulnerability hiding in WebGL textures! 🔥 Think of it like a sneaky intruder who finds a way to access the high-security vault of a bank simply by manipulating the layout of the lobby. Just as the bank’s security protocols should prevent unauthorized access, the web process should not allow these manipulations to escalate into more privileged areas. An attacker could exploit this to gain unauthorized access to sensitive data or even execute malicious code, leaving users vulnerable to devastating consequences. This could lead to a complete compromise of user systems or data breaches that are mind-blowingly serious!
Think of it like a sneaky intruder who finds a way to access the high-security vault of a bank simply by manipulating the layout of the lobby. Just as the bank’s security protocols should prevent unauthorized access, the web process should not allow these manipulations to escalate into more privileged areas. This vulnerability in Firefox and Thunderbird allows a compromised web process to perform out-of-bounds reads and writes by manipulating WebGL textures, potentially escalating privileges in the process.
An attacker could exploit this to gain unauthorized access to sensitive data or even execute malicious code, leaving users vulnerable to devastating consequences. This could lead to a complete compromise of user systems or data breaches that are mind-blowingly serious! Immediately update to the fixed versions: Firefox 144, Firefox ESR 115.29, Firefox ESR 140.4, and Thunderbird 144 or 140.4. Ensure that all users are using updated browsers to protect against this vulnerability. Conduct audits to confirm that outdated versions are not in use on any systems. You've got this! By taking these steps, you can keep your systems safe and sound. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| mozilla/firefox | < 115.29.0 | 115.29.0 |
| mozilla/firefox | < 144.0 | 144.0 |
| mozilla/firefox | ≥ 116.0, < 140.4.0 | 140.4.0 |
| mozilla/thunderbird | < 144.0 | 144.0 |