CVE-2025-4083

The error results from improper handling of 'javascript:' type URIs — content loaded by such a URI should be executed in the context of an isolated frame, however due to the error it reaches the top-level document process. This violates the process isolation boundary, which is a key element of the browser's security model. The result can be a sandbox escape, namely code execution outside the controlled sandbox environment.

An attacker can cause a sandbox escape from the browser or email client, potentially gaining the ability to execute malicious code in a privileged process context and compromising the confidentiality and integrity of user data.

Update to Firefox 138, Firefox ESR 128.10, Firefox ESR 115.23, Thunderbird 138, or Thunderbird 128.10 — depending on the product branch in use. Patches are available through Mozilla's automatic update mechanism and on the vendor's official website.

Mozilla Firefox in versions before 138 and before ESR 128.10 and ESR 115.23; Mozilla Thunderbird in versions before 138 and before 128.10.