{"id":"CVE-2025-2857","published":"2025-03-27T13:27:57Z","modified":"2026-06-09T16:23:02Z","title":"Incorrect handle could lead to sandbox escapes","vendor":"Mozilla","product":"Firefox","tier":"core","eol":null,"description":{"text":"Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a similar pattern in our IPC code. A compromised child process could cause the parent process to return an unintentionally powerful handle, leading to a sandbox escape. \nThe original vulnerability was being exploited in the wild. \n*This only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability was fixed in Firefox 136.0.4, Firefox ESR 128.8.1, and Firefox ESR 115.21.1.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is an incorrect handle exposure in Firefox's inter-process communication code on Windows, where the parent process can return an unintentionally powerful handle to a child process. An attacker who has compromised a sandboxed child process can abuse this to escape the sandbox, requiring no authentication or user interaction and only network access to deliver the attack.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T22:22:25Z"},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.01976,"percentile":0.80493,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-01-20","exploitedFirstSeen":"2026-01-20","ransomware":false,"evidence":[{"url":"https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025","date":"2026-01-20"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-668","name":"Exposure of Resource to Wrong Sphere"}],"references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1956398","tags":[]},{"url":"https://issues.chromium.org/issues/405143032","tags":[]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-2783","tags":[]},{"url":"https://www.mozilla.org/security/advisories/mfsa2025-19/","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-8495","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-8495","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2025-03-27","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2025-2857","provenance":"source"},{"date":"2026-01-20","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":63.1,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 285 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":16.1,"detail":"percentile 0.8049"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":7.0,"detail":"base score 10"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}