CVE-2025-0240

What it actually does

Parsing a JavaScript module as JSON can trigger cross-compartment access that leads to a use-after-free condition in memory handling.

Why it matters to the business

Attackers with local access may corrupt memory or alter limited program behavior, potentially causing instability or partial data manipulation in browser and email client sessions.

How an attack unfolds

An attacker crafts a malicious JavaScript module file that, when parsed as JSON under specific conditions, violates compartment boundaries and triggers a use-after-free; the flaw requires local execution and has not been observed in active campaigns.

How to fix it

Upgrade Mozilla Firefox to version 134 or later, Firefox ESR to 128.6 or later, Thunderbird to 134 or later, and Thunderbird ESR to 128.6 or later.

How to confirm the fix worked

Confirm installed product versions meet or exceed the fixed releases and re-test parsing of JavaScript modules as JSON in isolated environments.

Typical attack path

1. Place a specially crafted JavaScript module file on a system accessible to the victim application.
2. Trigger parsing of the file as JSON through normal application workflows or local invocation.
3. Exploit the resulting cross-compartment access to trigger use-after-free.
4. Leverage the freed memory for limited integrity impact such as data modification.

How to detect it

Review application logs and crash reports for unexpected memory access errors during JavaScript module handling; no widespread exploitation indicators have been published.

What your security team should do

• Prioritize patching Firefox and Thunderbird installations to the fixed versions.
• Monitor vendor advisories for any subsequent updates or additional affected products.
• Apply application allow-listing or sandboxing where local execution of untrusted modules is a concern.