Mozilla released Firefox 135.0.1 on February 18, 2025, as an emergency security update to patch multiple high-severity memory safety vulnerabilities.
The update specifically addresses CVE-2025-1414, a critical flaw that could enable arbitrary code execution and compromise user systems.
This marks the first major security patch for Firefox in 2025 and underscores ongoing challenges in browser security.
The vulnerabilities, classified as “high” impact by Mozilla’s security team, stemmed from memory safety flaws in Firefox 135’s JavaScript engine and graphics rendering components.
These bugs created scenarios where attackers could exploit memory corruption to crash browsers or execute malicious code.
According to Mozilla’s advisory, at least two of the patched vulnerabilities showed evidence of exploitability in controlled environments, though no active attacks have been confirmed.
Andrew McCreight, the Mozilla engineer credited with reporting the flaws, noted that the issues arose from race conditions in multi-threaded processes handling complex web content.
“Memory safety remains one of the most persistent challenges in large-scale software development,” McCreight stated in the advisory.
Firefox 135.0.1 is flagged as a mandatory update for all users, including those on Windows, macOS, and Linux.
Mozilla confirmed that the vulnerabilities affect Firefox 135 across all platforms, though mobile versions (Android/iOS) remain unaffected.
Users with automatic updates enabled should already have the patch, while others can trigger a manual update via “About Firefox” in the browser menu.
The update follows Mozilla’s accelerated response protocol for memory safety flaws, reflecting lessons learned from prior incidents like 2023’s CVE-2023-4863 zero-day exploit.
A Mozilla spokesperson emphasized, “Proactive patching is critical—even theoretical vulnerabilities demand immediate action given modern attack sophistication”.
Security researchers have praised the patch’s swift rollout but caution that users delaying updates remain vulnerable to drive-by downloads or malicious ads exploiting these flaws.
“Every hour counts when high-severity CVEs are public,” warned Tavis Ormandy of Google’s Project Zero.
Mozilla plans additional “stability enhancements” in Firefox 136, slated for March 4, 2025.
Meanwhile, users are advised to verify their browser version and enable automatic updates. Enterprises utilizing Firefox Extended Support Release (ESR) should expect backported fixes in ESR 135.1 within 72 hours.
This incident reinforces the critical role of update diligence in an era where unpatched browsers serve as primary attack vectors.
As cyber threats grow increasingly sophisticated, Mozilla’s rapid response exemplifies the collaborative security ethos underpinning open-source browser development.
Free Webinar: Better SOC with Interactive Malware Sandbox for Incident Response, and Threat Hunting - Register Here
A serious security flaw affecting the Eventin plugin, a popular event management solution for WordPress,…
A startling discovery in the npm ecosystem has revealed a highly sophisticated malware campaign embedded…
A newly identified ransomware campaign has emerged, seemingly targeting supporters of Elon Musk through a…
Procolored, a printer manufacturing company, has been found distributing software drivers infected with malicious code,…
Chinese intelligence operative posing as a Stanford University student has been uncovered following an investigation…
Security update KB5058379 for Windows 10, released in May 2025, is causing significant technical issues…
