While users were casually browsing the web, Mozilla engineers were scrambling to patch a slew of dangerous security holes. The company just released updates to fix multiple critical vulnerabilities affecting Firefox, Firefox ESR, Thunderbird, and mobile versions of Firefox for Android. Talk about bad timing.
These aren’t your run-of-the-mill bugs. We’re talking serious stuff – remote code execution vulnerabilities that could let attackers take control of your system. Memory safety bugs identified as CVE-2025-1937 affect all major Mozilla products, including Firefox 136 and Thunderbird 136. An integer overflow in SkRegion.cpp (CVE-2024-43097) causes out-of-bounds writes. Not good.
Critical vulnerabilities lurking in Mozilla products – attackers could seize control through memory exploits. Update immediately.
Users of older versions are sitting ducks. Firefox versions before 136, Firefox ESR prior to 115.21 and 128.8, and Thunderbird before version 136 are all vulnerable. Mozilla released security fixes specifically addressing use-after-free errors in XSLT and Custom Highlight components on February 4, 2025. Users with administrative privileges face a much higher risk if these vulnerabilities are exploited. Hackers love this stuff.
The exploitation methods are particularly nasty. Crafted media files can trigger out-of-bounds writes. Malicious web pages cause memory corruption. Even WebAssembly isn’t safe, with JIT corruption of WASM i32 return values on 64-bit CPUs. It’s a hacker’s buffet.
Mozilla didn’t discover all these problems on their own. Security researchers from Google Project Zero and Tencent Security deserve credit for finding some of these flaws. CERT-In highlighted multiple vulnerabilities in their January 20, 2025 advisory, weeks before Mozilla published their security advisories on March 4.
The good news? Patches are available now. Mozilla released security updates in Firefox 136 and Thunderbird 136. Firefox ESR 115.21 and 128.8 contain the critical fixes too. Most installations update automatically, but you might want to check anyway.
This whole mess underscores the ongoing security challenges in browser software. Bug bounty programs prove their worth again. Without them, who knows how many more flaws would remain undiscovered?
Meanwhile, regular users just want to check their email without getting hacked. Is that too much to ask?
