CVE-2025-8033

The JavaScript engine did not handle closed generators correctly and it was possible to resume them leading to a nullptr deref. This vulnerability was fixed in Firefox 141, Firefox ESR 115.26, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1.

• CWE-476

• https://bugzilla.mozilla.org/show_bug.cgi?id=1973990Permissions Required
• https://www.mozilla.org/security/advisories/mfsa2025-56/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2025-57/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2025-58/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2025-59/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2025-61/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2025-62/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2025-63/Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2025/07/msg00016.html

Published

Jul 22, 2025

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-8027On 64-bit platforms IonMonkey-JIT only wrote 32 bits of the …6.5
• CVE-2025-8028On arm64, a WASM `br_table` instruction with a lot of entrie…9.8
• CVE-2025-8029Thunderbird executed `javascript:` URLs when used in `object…8.1
• CVE-2025-8030Insufficient escaping in the “Copy as cURL” feature could po…8.1
• CVE-2025-8031The `username:password` part was not correctly stripped from…9.8
• CVE-2025-8032XSLT document loading did not correctly propagate the source…8.1
• CVE-2025-8034Memory safety bugs present in Firefox ESR 115.25, Firefox ES…8.8
• CVE-2025-8035Memory safety bugs present in Firefox ESR 128.12, Thunderbir…8.8
• CVE-2025-8036Thunderbird cached CORS preflight responses across IP addres…8.1
• CVE-2025-8037Setting a nameless cookie with an equals sign in the value s…9.1
• CVE-2025-8038Thunderbird ignored paths when checking the validity of navi…9.8
• CVE-2025-8039In some cases search terms persisted in the URL bar even aft…8.1