CVE-2025-3028
📋 TL;DR
This vulnerability allows JavaScript code to trigger a use-after-free condition during XSLT document transformations in Mozilla browsers and email clients. Attackers could exploit this to execute arbitrary code or cause crashes. Affected users include anyone running vulnerable versions of Firefox, Firefox ESR, or Thunderbird.
💻 Affected Systems
- Firefox
- Firefox ESR
- Thunderbird
📦 What is this software?
Firefox by Mozilla
Firefox by Mozilla
Firefox by Mozilla
Thunderbird by Mozilla
Thunderbird by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to full system compromise, data theft, or malware installation.
Likely Case
Browser/application crash (denial of service) or limited memory corruption leading to unstable behavior.
If Mitigated
No impact if systems are patched or have JavaScript disabled for untrusted content.
🎯 Exploit Status
Exploitation requires JavaScript execution during XSLT processing, which is common in web applications but requires specific conditions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firefox 137+, Firefox ESR 115.22+, Firefox ESR 128.9+, Thunderbird 137+, Thunderbird 128.9+
Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2025-20/
Restart Required: Yes
Instructions:
1. Open Firefox/Thunderbird. 2. Click menu → Help → About Firefox/Thunderbird. 3. Allow automatic update download and installation. 4. Restart when prompted.
🔧 Temporary Workarounds
Disable JavaScript
allPrevents JavaScript execution that could trigger the vulnerability during XSLT transformations.
In Firefox: about:config → javascript.enabled = false
Use Content Security Policy
allRestrict JavaScript execution on web servers to trusted sources only.
Add header: Content-Security-Policy: script-src 'self'
🧯 If You Can't Patch
- Restrict browser usage to trusted websites only
- Implement network segmentation to isolate vulnerable browsers from critical systems
🔍 How to Verify
Check if Vulnerable:
Check browser version against affected ranges: Firefox < 137, Firefox ESR < 115.22 or < 128.9, Thunderbird < 137 or < 128.9Check Version:
Firefox/Thunderbird: about:support → Application Basics → VersionVerify Fix Applied:
Confirm version is at or above patched versions: Firefox ≥ 137, Firefox ESR ≥ 115.22 or ≥ 128.9, Thunderbird ≥ 137 or ≥ 128.9📡 Detection & Monitoring
Log Indicators:
- Browser crash logs with XSLT-related stack traces
- Unexpected memory access errors in application logs
Network Indicators:
- HTTP requests to pages with XSLT transformations followed by browser crashes
SIEM Query:
source="browser_logs" AND (event="crash" AND message="XSLT" OR message="use-after-free")🔗 References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1941002
- https://www.mozilla.org/security/advisories/mfsa2025-20/
- https://www.mozilla.org/security/advisories/mfsa2025-21/
- https://www.mozilla.org/security/advisories/mfsa2025-22/
- https://www.mozilla.org/security/advisories/mfsa2025-23/
- https://www.mozilla.org/security/advisories/mfsa2025-24/
- https://lists.debian.org/debian-lts-announce/2025/04/msg00005.html
