CVE-2025-0237

The WebChannel API, which is used to transport various information across processes, did not check the sending principal but rather accepted the principal being sent. This could have led to privilege escalation attacks. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Thunderbird 134, and Thunderbird 128.6.

• CWE-863

• https://bugzilla.mozilla.org/show_bug.cgi?id=1915257Issue Tracking, Permissions Required
• https://www.mozilla.org/security/advisories/mfsa2025-01/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2025-02/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2025-04/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2025-05/Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2025/01/msg00004.html

Published

Jan 7, 2025

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-0231A vulnerability has been found in Codezips Gym Management Sy…8.8
• CVE-2025-0232A vulnerability was found in Codezips Blood Bank Management …8.8
• CVE-2025-0233A vulnerability was found in Codezips Project Management Sys…9.8
• CVE-2025-0234Out-of-bounds vulnerability in curve segmentation processing…5.3
• CVE-2025-0235Out-of-bounds vulnerability due to improper memory release d…5.3
• CVE-2025-0236Out-of-bounds vulnerability in slope processing during curve…5.3
• CVE-2025-0238Assuming a controlled failed memory allocation, an attacker …5.3
• CVE-2025-0239When using Alt-Svc, ALPN did not properly validate certifica…4
• CVE-2025-0240Parsing a JavaScript module as JSON could, under some circum…4
• CVE-2025-0241When segmenting specially crafted text, segmentation would c…7.7
• CVE-2025-0242Memory safety bugs present in Firefox 133, Thunderbird 133, …6.5
• CVE-2025-0243Memory safety bugs present in Firefox 133, Thunderbird 133, …5.1