Critical · published October 14, 2025
🚨 A crafty IPC message could turn privileged browser processes into open books! 🔥 Think of it like a waiter accidentally revealing the secret recipe to a dish while taking orders—if the kitchen is compromised, the whole menu could be exposed! Attackers could exploit this vulnerability to gain unauthorized access to sensitive information stored in the browser's memory. This means everything from passwords to personal data could be at risk, potentially leading to devastating privacy breaches.
Think of it like a waiter accidentally revealing the secret recipe to a dish while taking orders—if the kitchen is compromised, the whole menu could be exposed! CVE-2025-11710 allows a compromised web process to send malicious Inter-Process Communication (IPC) messages that can trick the privileged browser process into revealing its memory blocks to unauthorized processes.
Attackers could exploit this vulnerability to gain unauthorized access to sensitive information stored in the browser's memory. This means everything from passwords to personal data could be at risk, potentially leading to devastating privacy breaches. Upgrade immediately to Firefox 144, Thunderbird 144, or their respective ESR versions (115.29 and 140.4). It's essential to ensure all instances are patched to keep your data safe! You've got this! Stay vigilant and secure your browsing experience. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| mozilla/firefox | < 115.29.0 | 115.29.0 |
| mozilla/firefox | < 144.0 | 144.0 |
| mozilla/firefox | ≥ 116.0, < 140.4.0 | 140.4.0 |
| mozilla/thunderbird | < 140.4.0 | 140.4.0 |
| mozilla/thunderbird | ≥ 141.0, < 144.0 | 144.0 |