CVE-2025-3028
MediumCVSS 6.5Exploitation Probability (EPSS)
Elevated risk57th percentile - higher than 57% of all known CVEs
Summary
JavaScript code running while transforming a document with the XSLTProcessor could lead to a use-after-free. This vulnerability was fixed in Firefox 137, Firefox ESR 115.22, Firefox ESR 128.9, Thunderbird 137, and Thunderbird 128.9.
Risk Assessment
May lead to a browser crash or potentially arbitrary code execution in the user's context. Organizations using vulnerable versions are at risk from attacks using malicious documents.
Recommendation
Update Firefox and Thunderbird to the latest versions (Firefox 137, ESR 115.22, ESR 128.9, Thunderbird 137, 128.9).
Other vulnerabilities in Firefox, Thunderbird
See all- CVE-2026-16408Critical
Integer overflow in the Audio/Video: Playback component in Firefox and Thunderbird. Fixed in versions 153.
- CVE-2026-16395Critical
Integer overflow in the Audio/Video component in Firefox and Thunderbird. Fixed in versions 153.
- CVE-2026-6770Medium
A security issue exists in the Storage: IndexedDB component of the Firefox browser and the Thunderbird mail client. The vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
- CVE-2026-4729Critical
Memory safety bugs were found in Firefox 148 and Thunderbird 148. Some of these bugs showed evidence of memory corruption, which could potentially allow arbitrary code execution. The vulnerabilities were fixed in Firefox 149 and Thunderbird 149.
- CVE-2026-4720Critical
Memory safety bugs were found in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148. Some of these bugs showed evidence of memory corruption and could potentially be exploited to run arbitrary code with enough effort.
- CVE-2026-2807Critical
Memory safety bugs were found in Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruption and could potentially be exploited to run arbitrary code. The vulnerability was fixed in Firefox 148 and Thunderbird 148.
- CVE-2026-2792Critical
Memory safety bugs were found in Firefox ESR 140.7, Firefox 147, Thunderbird ESR 140.7, and Thunderbird 147. Some of these bugs showed evidence of memory corruption and could potentially be exploited to run arbitrary code with enough effort.
- CVE-2026-118008High
Privilege escalation vulnerability in the DOM: Navigation component. It was fixed in Firefox 159 and Thunderbird 159.
- CVE-2026-117991Low risk· EPSS 8%
The vulnerability stems from incorrect boundary conditions in the Layout: Text and Fonts component of Firefox and Thunderbird. It was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117990Low risk· EPSS 8%
The vulnerability allows a sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. It was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Original NVD description (English source)
JavaScript code running while transforming a document with the XSLTProcessor could lead to a use-after-free. This vulnerability was fixed in Firefox 137, Firefox ESR 115.22, Firefox ESR 128.9, Thunderbird 137, and Thunderbird 128.9.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS