Archive — US — techcrunch
Mozilla patches Firefox bug ‘exploited in the wild’, similar to bug attackingChrome
Mozilla patched a critical security bug (CVE-2025-2857) in Firefox for Windows, discovered to be actively exploited. The bug, which allows escaping the browser's sandbox, is similar to one recently fixed in Chrome. Affected versions include Firefox 136.0.4 and Tor Browser 14.0.7. Kaspersky noted ties to targeted attacks on journalists and government personnel in Russia.
Key points
- Mozilla released Firefox version 136.0.4 to fix CVE-2025-2857.
- The vulnerability was actively being exploited in the wild.
- The bug allows attackers to escape the browser's sandbox, compromising user data.
- A similar bug was patched in Chrome earlier, highlighting shared vulnerabilities due to common codebases.
- Tor Browser also received a patch (version 14.0.7) due to a similar vulnerability.
- The bug's exploitation has been linked to attacks on vulnerable groups like journalists and government employees in Russia.
Why it matters
- The incident reflects ongoing security challenges for widely used browsers amid increasing cyber threats.
- Exploitable vulnerabilities in browsers often relate to broader concerns around digital privacy and security.
- This trend signifies the importance of timely updates and patches in the IT industry to safeguard users, especially as remote work increases.
The timely response by Mozilla underscores the critical need for vigilance in browser security, especially given shared vulnerabilities with other platforms and the ongoing targeting of sensitive groups.