CVE-2025-1936
📋 TL;DR
This vulnerability in Firefox and Thunderbird allows attackers to hide malicious code in web extensions by disguising it as other file types like images. It exploits how jar: URLs handle null bytes in ZIP archive content retrieval, enabling code execution through disguised extensions. Affected users include anyone running vulnerable versions of Firefox, Firefox ESR, Thunderbird, or Thunderbird ESR.
💻 Affected Systems
- Firefox
- Firefox ESR
- Thunderbird
- Thunderbird ESR
📦 What is this software?
Firefox by Mozilla
Firefox by Mozilla
Thunderbird by Mozilla
Thunderbird by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution through malicious web extensions that appear as benign files, potentially leading to full system compromise.
Likely Case
Attackers trick users into installing malicious web extensions that bypass security checks, leading to data theft or further exploitation.
If Mitigated
Limited impact with proper extension vetting and user awareness, though risk remains for unpatched systems.
🎯 Exploit Status
Exploitation requires user interaction to install a malicious web extension. The vulnerability is publicly disclosed but no known public exploits exist.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firefox 136+, Firefox ESR 128.8+, Thunderbird 136+, Thunderbird ESR 128.8+
Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2025-14/
Restart Required: Yes
Instructions:
1. Open Firefox/Thunderbird. 2. Click menu → Help → About Firefox/Thunderbird. 3. Allow automatic update check and installation. 4. Restart the application when prompted.
🔧 Temporary Workarounds
Disable jar: protocol
allPrevents jar: URL processing in browser, which may break some legitimate functionality but eliminates this attack vector.
about:config → set network.jar.open-unsafe-types to false
Restrict extension installation
allOnly allow extensions from trusted sources like official add-on stores.
about:preferences → Privacy & Security → Allow extensions from → Select 'Only from Mozilla'
🧯 If You Can't Patch
- Implement application whitelisting to prevent execution of unauthorized browser extensions.
- Use network filtering to block downloads of .jar or .zip files from untrusted sources.
🔍 How to Verify
Check if Vulnerable:
Check browser version: Firefox/Thunderbird → Help → About. If version is below patched versions, system is vulnerable.Check Version:
firefox --version or thunderbird --version on Linux/macOS; check About dialog on Windows.Verify Fix Applied:
Confirm version is Firefox 136+, Firefox ESR 128.8+, Thunderbird 136+, or Thunderbird ESR 128.8+.📡 Detection & Monitoring
Log Indicators:
- Unusual extension installation events
- Jar file processing errors in browser logs
Network Indicators:
- Downloads of .jar or .zip files with unusual extensions
- Requests to jar: URLs with null bytes
SIEM Query:
source="browser_logs" AND (event="extension_install" AND extension_name NOT IN allowed_list) OR (url="jar:*\0*")🔗 References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1940027
- https://www.mozilla.org/security/advisories/mfsa2025-14/
- https://www.mozilla.org/security/advisories/mfsa2025-16/
- https://www.mozilla.org/security/advisories/mfsa2025-17/
- https://www.mozilla.org/security/advisories/mfsa2025-18/
- https://lists.debian.org/debian-lts-announce/2025/03/msg00006.html
