Edouard Bochin

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 138.0.4 Firefox ESR versions prior to 128.10.1 Firefox ESR versions prior to 115.23.1 **Description** An attacker was able to perform an out-of-bounds read or write on a JavaScript `Promise` object. This issue was demonstrated during Pwn2Own Berlin 2025, where it was used to trigger out-of-bounds memory access. The vulnerability allows for code execution. **Recommendations** For Firefox versions prior to 138.0.4, update to version 138.0.4 or later. For Firefox ESR versions prior to 128.10.1, update to version 128.10.1 or later. For Firefox ESR versions prior to 115.23.1, update to version 115.23.1 or later.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 133.0.6943.126 **Description** The issue allows a remote attacker to potentially exploit heap corruption via a crafted web app, due to a use after free in the Network component. The severity of this issue is classified as Medium by Chromium. **Recommendations** For versions prior to 133.0.6943.126, update to version 133.0.6943.126 or later to resolve the issue. As a temporary workaround, consider restricting the use of crafted web apps to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 123.0.6312.105 **Description** The issue is related to out of bounds memory access in the V8 engine of Google Chrome, allowing a remote attacker to perform arbitrary read/write via a crafted HTML page. This can lead to remote code execution. The vulnerability was demonstrated at Pwn2Own 2024, where it was successfully exploited, and the attackers earned $42,500. The Chromium security severity of this issue is High. **Recommendations** For Google Chrome versions prior to 123.0.6312.105, update to version 123.0.6312.105 or later to resolve the issue. As a temporary workaround, consider restricting access to potentially vulnerable web pages until the update is applied. Avoid using Google Chrome to access untrusted websites or HTML pages until the issue is resolved.