Mozilla has released an urgent security update to fix two critical vulnerabilities in Firefox. These flaws could allow attackers to execute malicious code on users’ computers with minimal user interaction.
Details of the Vulnerabilities
The issues affect multiple Firefox versions, including standard and Extended Support Release (ESR) editions. Attackers can exploit the vulnerabilities by tricking users into visiting specially crafted malicious websites, which trigger out-of-bounds memory operations in Firefox’s JavaScript engine.
Two severe vulnerabilities—tracked as CVE-2025-4918 and CVE-2025-4919—were discovered by security researchers working with Trend Micro’s Zero Day Initiative. Mozilla has rated both as “critical.”
CVE-2025-4918
This flaw involves out-of-bounds read or write when handling JavaScript Promise objects. Researchers Edouard Bochin and Tao Yan of Palo Alto Networks reported the issue. According to Mozilla, “An attacker could perform an out-of-bounds read or write on a JavaScript Promise object,” which may lead to arbitrary code execution.
CVE-2025-4919
This vulnerability allows attackers to cause out-of-bounds read or write by confusing array index sizes on JavaScript objects. Security researcher Manfred Paul identified this flaw.
Affected Versions and Impact
The vulnerabilities impact the following Firefox versions:
- Firefox versions prior to 138.0.4
- Firefox ESR versions prior to 128.10.1 and 115.23.1
Security firm Cybersecurity Help notes the affected range includes Firefox 110.0 through 138.0.3 and ESR versions 102.0 through 128.10.0.
Both vulnerabilities carry a CVSS 3.1 base score of 8.8 (High), indicating a serious risk of remote code execution if exploited.
Immediate Update Recommended
Mozilla swiftly addressed these flaws after demonstrations at the Pwn2Own 2025 security contest. Users are strongly advised to update Firefox immediately to:
- Firefox 138.0.4
- Firefox ESR 128.10.1
- Firefox ESR 115.23.1
To update, users can select Help > About Firefox from the browser menu. Mac users should select About Firefox from the Firefox menu.
Expert Advice
Security experts warn these vulnerabilities could already be exploited in the wild. Promptly applying updates is critical to protect systems and personal data from compromise.
As web-based attacks grow more sophisticated, keeping browsers and software up to date remains a key defense.
