https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-04T18:35:38.410656+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2025-0237 CVE-2025-0237 — WebChannel APIs susceptible to confused deputy attack 2026-10-04T18:35:38.415865+00:00

Affected: Mozilla Firefox, Mozilla Thunderbird

The WebChannel API, which is used to transport various information across processes, did not check the sending principal but rather accepted the principal being sent. This could have led to privilege escalation attacks. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Thunderbird 134, and Thunderbird 128.6.

 https://vulnerability.circl.lu/vuln/usn-7191-1 USN-7191-1 — firefox vulnerabilities 2026-10-04T18:35:38.415967+00:00

Affected: Ubuntu:20.04:LTS: firefox

Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information across domains, or execute arbitrary code. (CVE-2025-0237, CVE-2025-0239, CVE-2025-0240, CVE-2025-0242, CVE-2025-0243, CVE-2025-0247)

Irvan Kurniawan discovered that Firefox incorrectly handled memory when breaking lines in text, leading to a use-after-free vulnerability. An attacker could possibly use this issue to cause a denial of service or possibly execute arbitrary code. (CVE-2025-0238)

Nils Bars discovered that Firefox incorrectly handled memory when using JavaScript Text Segmentation. An attacker could possibly use this issue to cause a denial of service. (CVE-2025-0241)