Overview
An alarming vulnerability, CVE-2025-4918, has been detected in certain versions of Firefox, Firefox ESR, and Thunderbird, affecting their JavaScript `Promise` object. This critical issue permits an attacker to perform an out-of-bounds read or write operation, resulting in potential system compromise and data leakage. Given the widespread use of the affected software, this vulnerability is of significant concern.
Vulnerability Summary
CVE ID: CVE-2025-4918
Severity: High (CVSS: 7.5)
Attack Vector: Network
Privileges Required: None
User Interaction: Required
Impact: System compromise and potential data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
Firefox | < 138.0.4 Firefox ESR | < 128.10.1 Firefox ESR | < 115.23.1 Thunderbird | < 128.10.2 Thunderbird | < 138.0.2 How the Exploit Works
The exploit takes advantage of a flaw in the JavaScript `Promise` object present in the affected browsers. An attacker can craft a malicious web page or script that, when interacted with by the victim, allows the attacker to perform out-of-bounds read or write operations. This can lead to unauthorized access to data, system instability, or even complete system compromise.
Conceptual Example Code
Consider the following conceptual example, which illustrates a possible exploitation scenario:
let promise = new Promise((resolve, reject) => {
// Malicious code here
let array = new Array(-1);
resolve(array);
});
promise.then((value) => {
// Out-of-bounds read/write operation here
value[123456] = "exploit";
});In this conceptual example, a `Promise` is created with a negative array size, which is an invalid operation. The attacker then performs an out-of-bounds write operation in the `then` method, potentially leading to undefined behavior, system instability, or a compromise.
