Critical Security Update for Firefox: Addressing Multiple Vulnerabilities
Summary
ALSA-2025:4458: Important: firefox security update. Affects firefox versions < 128.10.0-1.el8_10.alma.1. Fixed in 128.10.0-1.el8_10.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mozilla Firefox is a widely used open-source web browser known for its commitment to standards compliance, performance, and portability. It supports various web technologies and is favored for its user privacy features. However, like any software, it is susceptible to vulnerabilities that can compromise user security and data integrity.
Vulnerability Detail
The vulnerabilities identified in this update include privilege escalation in the Firefox Updater (CVE-2025-2817), unsafe attribute access during XPath parsing (CVE-2025-4087), process isolation bypass using 'javascript:' URI links in cross-origin frames (CVE-2025-4083), and multiple memory safety bugs (CVE-2025-4091, CVE-2025-4093). These issues can lead to unauthorized access, data leakage, and potential exploitation by malicious actors, emphasizing the need for immediate attention.
How To Fix
Minimum fixed version
128.10.0-1.el8_10.alma.1
This is the first release that contains the fix.
sudo dnf update firefoxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using features that rely on the affected components, such as disabling JavaScript in cross-origin frames. However, this is not a permanent solution and updating to the latest version is strongly recommended.
Conclusion
The recent security update for Firefox addresses critical vulnerabilities that could potentially compromise user security. It is essential for users to update to the latest version to protect against these threats. Utilizing tools like Vulert can further enhance security by monitoring for vulnerabilities in real-time.
See every vulnerability recorded for firefox →
FAQ
The vulnerabilities include privilege escalation, unsafe attribute access, process isolation bypass, and memory safety issues, which can lead to unauthorized access and data leakage.
You can check your Firefox version by navigating to 'Help' > 'About Firefox'. Compare it with the patched version 128.10.0-1.el8_10.alma.1.
If an immediate update is not possible, consider disabling JavaScript in cross-origin frames as a temporary workaround.
Detailed information can be found on the CVE pages for each vulnerability: CVE-2025-2817, CVE-2025-4083, CVE-2025-4087, CVE-2025-4091, and CVE-2025-4093.
Vulert monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json. You can check your application for vulnerabilities in real-time using the Vulert playground without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for firefox.
