CVE-2025-0237mediumCWE-863

CVE-2025-0237: medium-severity vulnerability in Mozilla Firefox

WebChannel APIs susceptible to confused deputy attack

Published · Updated

Follow this CVE+ Monitor Firefox+ Monitor Thunderbird

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.4epss 0.6%
The WebChannel API, which is used to transport various information across processes, did not check the sending principal but rather accepted the principal being sent. This could have led to privilege escalation attacks. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Thunderbird 134, and Thunderbird 128.6.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Affected products
Mozilla · FirefoxMozilla · Thunderbird
Related CVEs — Mozilla Firefox

In the same product, most dangerous first.

CVE-2016-9079HIGHCVE-2016-9079EPSS 87.4%KEVCVE-2019-11708CRITICALCVE-2019-11708EPSS 55.9%KEVCVE-2019-17026HIGHCVE-2019-17026EPSS 46.3%KEVCVE-2019-11707HIGHCVE-2019-11707EPSS 38.0%KEVCVE-2024-9680CRITICALCVE-2024-9680EPSS 23.2%KEVCVE-2022-26485HIGHCVE-2022-26485EPSS 14.3%KEV