PatchGap
Firefox · Core

CVE-2025-1930

UAF in Core
High CVSS 8.8 firefox UAF

Overview

High
Severity
8.8
CVSS
No
Exploited ITW
Embargoed
Fix Status
Impacthigh
DescriptionOn Windows, a compromised content process could use bad StreamData sent over AudioIPC to trigger a use-after-free in the Browser process. This could have led to a sandbox escape.
ComponentCore
Bug ClassUAF
Tracker1902309
CWECWE-416 (Use-after-free)
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA KEVNot listed
Crediteddalmurino
Disclosed2025-03-04

Fix not yet public

No public source fix for this bug has been identified on the main branch yet — it is embargoed or not yet disclosed. Root-cause analysis is withheld until the fix commit is available.
On This Page