Critical · published December 9, 2025
🚨 A use-after-free vulnerability in WebRTC could leave your Firefox or Thunderbird wide open to exploits, and it's all thanks to a sneaky pointer mismanagement! 🔥 Think of a use-after-free flaw like a restaurant that keeps serving dishes that have already been cleared from the table — if the chef doesn’t double-check, they might just serve up something that could make your guests very ill! If exploited, an attacker could potentially execute arbitrary code, leading to full control over the application. Imagine giving a complete stranger the keys to your home because you mistook them for a trusted guest – that’s how dangerous this flaw could be!
Think of a use-after-free flaw like a restaurant that keeps serving dishes that have already been cleared from the table — if the chef doesn’t double-check, they might just serve up something that could make your guests very ill! This vulnerability occurs in the WebRTC signaling component, where a reference is accessed after it has been freed, allowing attackers to manipulate memory. This seemingly simple oversight could open doors to devastating exploits.
If exploited, an attacker could potentially execute arbitrary code, leading to full control over the application. Imagine giving a complete stranger the keys to your home because you mistook them for a trusted guest – that’s how dangerous this flaw could be! Update your Firefox to version 146 or Firefox ESR 140.6, and Thunderbird to version 146 or 140.6 immediately. Don't skip this step—ensure all users and systems are patched to stay safe. You've got this! By following these steps, you'll keep your applications secure and your data safe. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| mozilla/firefox | < 140.6.0 | 140.6.0 |
| mozilla/firefox | < 146.0 | 146.0 |
| mozilla/thunderbird | < 140.6.0 | 140.6.0 |
| mozilla/thunderbird | < 146.0 | 146.0 |