Critical · published June 24, 2025
🚨 A use-after-free vulnerability in FontFaceSet could lead to a crash that leaves your Firefox or Thunderbird feeling a bit tipsy! 🔥 Think of it like a waiter serving a dish that’s already been sent back to the kitchen — it’s an order that can lead to chaos if not dealt with correctly. When this happens in your browser, it could disrupt your entire experience, leaving you vulnerable to crashes and unexpected behavior. If exploited, this vulnerability could lead to a crash in your browser or email client, potentially allowing attackers to gain sensitive information or execute malicious code. It's critical because such crashes could be the gateway for more severe attacks, leaving your data in a precarious position. You wouldn't want your browser to become a stage for such trouble!
Think of it like a waiter serving a dish that’s already been sent back to the kitchen — it’s an order that can lead to chaos if not dealt with correctly. When this happens in your browser, it could disrupt your entire experience, leaving you vulnerable to crashes and unexpected behavior. This vulnerability stems from a use-after-free error in the FontFaceSet interface, which fails to correctly manage memory, allowing an attacker to manipulate the application's state. This oversight could lead to a crash, opening the door for further exploitation.
If exploited, this vulnerability could lead to a crash in your browser or email client, potentially allowing attackers to gain sensitive information or execute malicious code. It's critical because such crashes could be the gateway for more severe attacks, leaving your data in a precarious position. You wouldn't want your browser to become a stage for such trouble! Update immediately to Firefox 140, Firefox ESR 115.25, or Thunderbird 140. If you're running an older version, it's crucial to prioritize this update and ensure that your systems are patched effectively. Regularly check for future updates as well! You've got this! By following these steps, you'll have your browser and email client secured in no time. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| mozilla/firefox | < 115.25.0 | 115.25.0 |
| mozilla/firefox | < 140.0 | 140.0 |
| mozilla/firefox | ≥ 116.0, < 128.12.0 | 128.12.0 |