Full Report
Mozilla released emergency security updates to address two Firefox zero-day vulnerabilities demonstrated in the recent Pwn2Own Berlin 2025 hacking competition. [...]
Analysis Summary
# Vulnerability: Firefox Zero-Day Exploited at Pwn2Own Involving JavaScript Object Out-of-Bounds Access
## CVE Details
- CVE ID: Not explicitly stated in the provided text (Two zero-days were patched, but individual CVEs are missing)
- CVSS Score: Not explicitly stated, but rated **"critical"** by Mozilla.
- CWE: Related to out-of-bounds reads/writes on a JavaScript object.
## Affected Systems
- Products: Mozilla Firefox
- Versions: Pre-patch versions (Specific vulnerable versions not listed, but fixed in 138.0.4, ESR 128.10.1, and ESR 115.23.1)
- Configurations: Not specified beyond using the affected Firefox versions.
## Vulnerability Description
The vulnerability involves an out-of-bounds read/write condition on a JavaScript object. An attacker could confuse array index sizes within the JavaScript engine, leading to unauthorized memory access. Although discovered during a contest, security researchers confirmed they *could not* achieve a sandbox escape, likely due to recent architectural hardening in the Firefox sandbox.
## Exploitation
- Status: **PoC available** (Demonstrated successfully at Pwn2Own Berlin 2025).
- Complexity: Implied to be achievable by skilled security researchers.
- Attack Vector: Implied to be network/remote, requiring user interaction (visiting a malicious page) within the browser context, leading to renderer access.
## Impact
- Confidentiality: High (Potential for information disclosure via out-of-bounds read)
- Integrity: High (Potential for arbitrary code execution/modification via out-of-bounds write)
- Availability: Moderate (Potential for crash/denial of service in the renderer process)
## Remediation
### Patches
Users are recommended to upgrade immediately to one of the following patched versions:
- Firefox: **version 138.0.4** (Referencing MFSA 2025-36)
- Firefox ESR: **version 128.10.1** (Referencing MFSA 2025-37)
- Firefox ESR: **version 115.23.1** (Referencing MFSA 2025-38)
### Workarounds
No specific workarounds were mentioned. Immediate patching is the primary recommendation due to in-the-wild demonstration (even if limited to the contest).
## Detection
- Indicators of compromise: Since the flaw was demonstrated in a contest environment, specific IoCs are generally not public immediately unless incorporated into malware. Detection would rely on monitoring processes attempting unusual memory access patterns within the Firefox renderer.
- Detection methods and tools: Monitoring network traffic for connections leading to known exploit delivery sites, or using advanced endpoint detection and response (EDR) solutions capable of tracking memory safety violations within browser processes.
## References
- Vendor Advisories:
- MFSA 2025-36
- MFSA 2025-37
- MFSA 2025-38
- Relevant links:
- hxxps://blog.mozilla.org/security/2025/05/17/firefox-security-response-to-pwn2own-2025/
- hxxps://www.bleepingcomputer.com/news/security/mozilla-fixes-firefox-zero-days-exploited-at-hacking-contest/