2 min read
|
Saved February 14, 2026
|
Copied!
Do you care about this?
A serious vulnerability in Firefox, identified as CVE-2025-13016, could have allowed attackers to execute arbitrary code on users' devices. The flaw stemmed from a coding error in the browser's WebAssembly engine, affecting versions 143 to early 145. Mozilla quickly addressed the issue with a patch released on November 11, 2025.
If you do, here's more
A significant vulnerability in Firefox, tracked as CVE-2025-13016, was discovered by AISLE, an AI security firm. This flaw stemmed from a minor coding error in the browser's WebAssembly engine and could have allowed attackers to execute unauthorized code on users' computers, putting over 180 million users at risk. The core issue was a stack buffer overflow caused by a miscalculation involving memory pointers, which led to excessive data being written into memory, corrupting other data. The vulnerability was present in multiple Firefox versions released between April 7, 2025, and early 145, including various ESR versions, despite a test designed to catch such flaws failing to do so.
The vulnerability was identified on October 2, 2025, and promptly reported to Mozilla. Within two weeks, the Mozilla security team confirmed the issue, and a fix was implemented the next day. A public patch was released on November 11, 2025. The flaw was rated with a CVSS score of 7.5, indicating high severity. Exploiting the vulnerability required a user to visit a malicious website during specific conditions, like high memory pressure. While all major platforms, including Windows, macOS, Linux, and Android, were affected, older versions such as Firefox ESR 115 and any version prior to 143 were safe. Users are strongly urged to update to the latest version, Firefox 145 or ESR 140.5 and later, to protect themselves from potential exploitation.
Questions about this article
No questions yet.