Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a similar pattern in our IPC code. A compromised child process could cause the parent process to return an unintentionally powerful handle, leading to a sandbox escape.
The original vulnerability was being exploited in the wild.
*This only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability was fixed in Firefox 136.0.4, Firefox ESR 128.8.1, and Firefox ESR 115.21.1.

Published: 2025-03-27

CVSS: 10.0

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Download Exploit for CVE-2025-2857 here:

Use Tor Browser to access .onion links.

Check our team here:

https://tatramed.sk/exploit-697-cve-2025-12816/

https://tatramed.sk/exploit-775-cve-2025-59282/

https://tatramed.sk/exploit-227-cve-2024-54534/