{"id":"CVE-2025-2857","published":"2025-03-27T13:27:57Z","modified":"2026-06-09T16:23:02Z","title":"Incorrect handle could lead to sandbox escapes","vendor":"Mozilla","product":"Firefox","tier":"core","eol":null,"description":{"text":"Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a similar pattern in our IPC code. A compromised child process could cause the parent process to return an unintentionally powerful handle, leading to a sandbox escape. \nThe original vulnerability was being exploited in the wild. \n*This only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability was fixed in Firefox 136.0.4, Firefox ESR 128.8.1, and Firefox ESR 115.21.1.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":10,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.01976,"percentile":0.80444,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-01-20","exploitedFirstSeen":"2026-01-20","ransomware":false,"evidence":[{"url":"https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025","date":"2026-01-20"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":4,"pulses":[{"name":"EbeeOct2025 Pt4","url":"https://otx.alienvault.com/pulse/69032eeb91df61e525fe5741","created":"2025-10-30"},{"name":"Dante Spyware Delivered via Personalized Forum Lures and Browser Zero-Day","url":"https://otx.alienvault.com/pulse/69002cf9e851424b7aec5992","created":"2025-10-28"},{"name":"Mem3nt0 mori – The Hacking Team is back!","url":"https://otx.alienvault.com/pulse/68ff293ee20a0d1e342936c8","created":"2025-10-27"},{"name":"New Chaos RAT Variants Threaten Windows and Linux Systems with Stealthy Data Theft","url":"https://otx.alienvault.com/pulse/6843300336b121603e3cffad","created":"2025-06-06"}],"provenance":"machine"},"cwes":[{"id":"CWE-668","name":"Exposure of Resource to Wrong Sphere"}],"references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1956398","tags":[]},{"url":"https://issues.chromium.org/issues/405143032","tags":[]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-2783","tags":[]},{"url":"https://www.mozilla.org/security/advisories/mfsa2025-19/","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-8495","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-8495","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2025-03-27","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2025-2857","provenance":"source"},{"date":"2026-01-20","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":64.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 283 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":16.09,"detail":"percentile 0.8044"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":1.59,"detail":"4 pulses"},{"name":"CVSS severity","points":7.0,"detail":"base score 10"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}