Firefox Zero-Days Exploited CVE-2025-4918 & CVE-2025-4919

May 19, 2025

🚨 Firefox Zero-Days Exploited at Pwn2Own Berlin – What Happened?

Mozilla has released urgent security updates addressing two critical zero-day vulnerabilities actively exploited in the wild, uncovered during the Pwn2Own Berlin 2025 security competition.

The affected vulnerabilities are:

  • CVE-2025-4918: Out-of-bounds access vulnerability during Promise resolution in JavaScript.
  • CVE-2025-4919: Out-of-bounds access vulnerability during linear sum optimization by the JavaScript JIT compiler.

Both flaws were demonstrated in successful exploit chains at Pwn2Own, which awarded researchers for their ability to trigger code execution through these bugs.

🔍 Technical Overview – CVE-2025-4918 and CVE-2025-4919

CVE-2025-4918

  • Type: Out-of-bounds access
  • Component: JavaScript engine (Promise resolution)
  • Impact: Potential out-of-bounds read/write, leading to arbitrary code execution
  • Attack Vector: Crafted web content can trigger the flaw when interacting with Promise objects

CVE-2025-4919

  • Type: Out-of-bounds access
  • Component: JIT Compiler
  • Impact: Memory corruption during sum optimization, leading to arbitrary code execution
  • Attack Vector: JavaScript execution in a browser context

Mozilla has confirmed both vulnerabilities are being exploited in the wild and released emergency patches for Firefox and Firefox ESR.

🎯 Affected Products and Versions

  • All versions prior to Firefox 138.0.4 (including Firefox for Android)
  • Firefox ESR prior to v128.10.1
  • Firefox ESR prior to v115.23.1

⚙️ Mitigation and Patch Guidance

Mozilla users are strongly advised to upgrade immediately to the latest patched versions:

  • Firefox version 138.0.4
  • Firefox ESR 128.10.1
  • Firefox ESR 115.23.1

You can update Firefox by navigating to:
Menu → Help → About Firefox → Update

For enterprises using endpoint management tools, verify update deployment across all Windows, macOS, and Linux endpoints.

🧩 Detection and Indicators of Compromise (IOCs)

While Mozilla has not published specific IOCs, organizations should monitor for:

Behavioral Indicators

  • Unusual JavaScript execution patterns in browser logs
  • Unexpected process spawns from firefox.exe or equivalent
  • Surges in memory-related crash reports involving js::PromiseObject or JIT execution paths

SIEM Search Queries

Here are example queries for common SIEM platforms:

🧠 Elastic (KQL):

process.name: "firefox.exe" and process.command_line: "*Promise*"

🕵️ Splunk:

index=windows sourcetype=Sysmon process_name=firefox.exe ("Promise" OR "jit")

⚙️ Wazuh:

rule.level:5 AND data.win.system.provider_name: "Mozilla" AND (data.win.eventdata.param1:"Promise" OR "jit")

🛡️ Microsoft Sentinel (KQL):

DeviceProcessEvents | where FileName == "firefox.exe" and ProcessCommandLine contains "Promise"

✅ Patch Firefox and Firefox ESR immediately

🔒 Consider temporarily disabling JavaScript in sensitive environments

🔍 Monitor SIEM logs for suspicious Firefox behavior

🧰 Leverage browser isolation or containerization for high-risk users

🛡️ Enable EDR and application control to mitigate post-exploitation attempts

🔐 Strengthen Your Cybersecurity Posture

Given the remote code execution capabilities of this vulnerability and the increased focus of attackers on web browsers, it’s imperative to ensure your systems are protected. Our Patch Management Services can assist in timely updates and continuous monitoring to safeguard your infrastructure against such threats. In addition, our 24/7/365 MXDR and proactive threat hunting can help identify indicators of compromise and suspicious activity quickly, allowing for rapid response zero-day vulnerabilities.

Don’t leave your systems exposed. Our expert team can help you patch vulnerabilities promptly and monitor for threats continuously. Learn more about our Patch Management Services.

🔗 References