Mozilla has officially released Firefox 138, marking a significant update focused on user security. The new version addresses multiple high-severity vulnerabilities, following the Mozilla Foundation Security Advisory 2025-28.
The Firefox browser continues its tradition of proactive security practices, ensuring users are protected from the latest threats.
Announced on April 29, 2025, Firefox 138 includes critical patches for vulnerabilities that, if exploited, could lead to privilege escalation, memory corruption, or even arbitrary code execution.
Mozilla has credited security researchers from around the world for responsibly reporting these flaws.
The security advisory highlights four notable CVEs (Common Vulnerabilities and Exposures) fixed in this release.
Below is a summary table of the vulnerabilities, their descriptions, and affected products:
| CVE | Title | Impact | Affected Product(s) |
| CVE-2025-2817 | Privilege escalation in Firefox Updater | High | Firefox |
| CVE-2025-4082 | WebGL shader attribute memory corruption (macOS only) | High | Firefox for macOS |
| CVE-2025-4083 | Process isolation bypass via “javascript:” URI links in frames | High | Firefox |
| CVE-2025-4092 | Memory safety bugs (also affects Thunderbird 138) | High | Firefox, Thunderbird |
These vulnerabilities, though discovered by security experts and Mozilla’s own fuzzing team, are deemed high risk due to their potential impact.
Privilege escalation, process isolation bypass, and memory corruption can have far-reaching consequences, from compromising user data to facilitating malicious code execution.
Mozilla strongly urges all users to update their browsers to Firefox 138 as soon as possible. Mac users, in particular, should install the update promptly due to the WebGL-specific issue.
Thunderbird users should also check for updates, as one of the memory safety bugs (CVE-2025-4092) affects both products.
With this release, Mozilla once again reinforces its commitment to security and transparency.
Users should remain vigilant by keeping their browsers updated and watching for future advisories. Firefox 138 is now available for download across all supported platforms.
Find this News Interesting! Follow us on Google News, LinkedIn, & X to Get Instant Updates!
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…