Overview
The cybersecurity world has been shaken with the revelation of a severe vulnerability affecting popular software products like Firefox and Thunderbird. Identified as CVE-2025-8028, this vulnerability has a potential to compromise systems or lead to data leakage, making it a significant threat to personal and corporate users of the affected software. In particular, this vulnerability arises due to an erroneous computation of the branch address in a WASM `br_table` instruction on arm64. This can result in truncation and incorrect computations, thereby creating a loophole for potential cyber attacks.
Vulnerability Summary
CVE ID: CVE-2025-8028
Severity: Critical, CVSS Score 9.8
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: Potential system compromise or data leakage
Affected Products
Share secrets securely
Ameeba is private infrastructure for communication and sensitive work built on encrypted identity instead of exposed corporate identity systems.
Passwords, credentials, confidential files, screenshots, internal discussions, sensitive AI context, and private coordination should not become exposed across ordinary communication platforms.
- • Encrypted identity
- • Private Spaces for organizations and teams
- • End-to-end encrypted chat, calls, files, and notes
- • Sensitive AI work and protected collaboration
- • Built for information that cannot leak
Our mission is to secure human work alongside AI.
Product | Affected Versions
Firefox | < 141 Firefox ESR | < 115.26, < 128.13, < 140.1 Thunderbird | < 141, < 128.13, < 140.1 How the Exploit Works
The exploit leverages the vulnerability in the WASM `br_table` instruction on arm64 architectures, which can lead to the label being too far from the instruction. This distance causes truncation and incorrect computation of the branch address. An attacker can exploit this flaw to execute malicious code, potentially compromising the system or leading to data leakage.
Conceptual Example Code
While it’s not possible to provide a direct example of how to exploit this vulnerability without promoting harmful actions, we can discuss it in a hypothetical context. An attacker might craft a malicious WASM code that triggers the `br_table` instruction issue. This code, once loaded and run on the affected software, could perform unauthorized actions. This is a conceptual presentation and does not represent actual exploit code:
(module
(func $vulnerableFunction (param $index i32)
(block $default
(block $block1
(block $block2
(block $block3
;; A br_table instruction with a large number of entries.
(br_table $block1 $block2 $block3 $default
(get_local $index)
)
)
)
)
)
)
)In this conceptual example, the `br_table` instruction references several blocks. If the `$index` parameter is manipulated to reference a block too far from the instruction, it triggers the vulnerability, leading to incorrect computations and potential system compromise.