CVE-2025-4918

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 138.0.4 Firefox ESR versions prior to 128.10.1 Firefox ESR versions prior to 115.23.1

Description An attacker was able to perform an out-of-bounds read or write on a JavaScript Promise object. This issue was demonstrated during Pwn2Own Berlin 2025, where it was used to trigger out-of-bounds memory access. The vulnerability allows for code execution.

Recommendations For Firefox versions prior to 138.0.4, update to version 138.0.4 or later. For Firefox ESR versions prior to 128.10.1, update to version 128.10.1 or later. For Firefox ESR versions prior to 115.23.1, update to version 115.23.1 or later.