CVE-2025-3028Medium· 6.5▾ SunlitJavaScript code running while transforming a document with the XSLTProcessor could lead to a use-after-free. This vulnerability was fixed in Firefox 137, Firefox ESR 115.22, Firefox ESR 128.9, Thunderbird 137, and Thunderbird 128.9.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.9%
0.9% → 0.9%
Last analysed / modified upstream
JavaScript code running while transforming a document with the XSLTProcessor could lead to a use-after-free. This vulnerability was fixed in Firefox 137, Firefox ESR 115.22, Firefox ESR 128.9, Thunderbird 137, and Thunderbird 128.9.
firefox < 115.22.0firefox < 137.0firefox >= 116.0, < 128.9.0thunderbird < 128.9.0thunderbird >= 129.0, <= 137.0Upgrade past the affected range:
firefox 128.9.0thunderbird 128.9.0Connected by shared product, vendor, weakness, or advisory.
CVE-2025-3030High· 8.1Memory safety bugs present in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8
CVE-2025-3029High· 7.3A crafted URL containing specific Unicode characters could have hidden the true origin of the page, resulting in a potential spoofing attack
CVE-2025-3033High· 7.7After selecting a malicious Windows `.url` shortcut from the local filesystem, an unexpected file could be uploaded
CVE-2025-3034High· 8.1Memory safety bugs present in Firefox 136 and Thunderbird 136
CVE-2025-3031Medium· 6.5An attacker could read 32 bits of values spilled onto the stack in a JIT compiled function
CVE-2025-3032High· 7.4Leaking of file descriptors from the fork server to web content processes could allow for privilege escalation attacks