CVE-2023-25742

What it actually does

Improper input validation during import of an SPKI-formatted RSA public key treated as ECDSA P-256 leads to incorrect key handling and immediate tab crash.

Why it matters to the business

Unexpected tab closures interrupt user browsing and email workflows in affected Mozilla products; low exploitation likelihood reduces urgency but still requires patching to maintain stability across large deployments.

How an attack unfolds

An attacker crafts content that triggers import of a malformed SPKI RSA key as an ECDSA P-256 key; when the victim loads the page or message the application mishandles the key and crashes the tab. No named threat actors or ransomware campaigns are associated with this issue.

How to fix it

Upgrade Mozilla Firefox to 110 or later, Firefox ESR to 102.8 or later, and Thunderbird to 102.8 or later.

How to confirm the fix worked

Confirm installed versions meet or exceed the fixed releases; attempt controlled import of an SPKI RSA key as ECDSA P-256 and verify no crash occurs.

Typical attack path

1. Attacker prepares a web page or email containing JavaScript or content that performs an SPKI RSA-to-ECDSA P-256 key import
2. Victim visits the page or opens the message in an affected browser or client
3. Application performs the import operation without proper validation
4. Tab crashes due to mishandled key material

How to detect it

Examine browser crash reports and logs for entries referencing SPKI, RSA, or ECDSA key import failures; correlate with user reports of sudden tab closures after visiting untrusted sites or opening emails.

What your security team should do

• Apply the version upgrades to all affected Mozilla products as soon as feasible
• Enable automatic updates where organizational policy permits
• Review crash-reporting telemetry for any spikes tied to key-import operations