CVE-2025-1933High· 7.6▾ TwilightOn 64-bit CPUs, when the JIT compiles WASM i32 return values they can pick up bits from left over memory. This can potentially cause them to be treated as a different type. This vulnerability was fixed in Firefox 136, Firefox ESR 115.21,…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
On 64-bit CPUs, when the JIT compiles WASM i32 return values they can pick up bits from left over memory. This can potentially cause them to be treated as a different type. This vulnerability was fixed in Firefox 136, Firefox ESR 115.21, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8.
firefox < 115.21.0firefox < 136.0firefox >= 116.0, < 128.8.0thunderbird < 128.8thunderbird >= 129.0, < 136.0Upgrade past the affected range:
firefox 128.8.0thunderbird 136.0Connected by shared product, vendor, weakness, or advisory.
CVE-2025-1934Medium· 6.5It was possible to interrupt the processing of a RegExp bailout and run additional JavaScript, potentially triggering garbage collection when the engine was not expecting it
CVE-2025-1935Medium· 4.3A web page could trick a user into setting that site as the default handler for a custom URL protocol
CVE-2025-1936High· 7.3jar: URLs retrieve local file content packaged in a ZIP archive
CVE-2025-1931High· 7.5It was possible to cause a use-after-free in the content process side of a WebTransport connection, leading to a potentially exploitable crash
CVE-2025-1932High· 8.1An inconsistent comparator in xslt/txNodeSorter could have resulted in potentially exploitable out-of-bounds access
CVE-2025-1930High· 8.8On Windows, a compromised content process could use bad StreamData sent over AudioIPC to trigger a use-after-free in the Browser process