CVE-2025-1930
Published: 04 March 2025
Summary
CVE-2025-1930 is a high-severity Use After Free (CWE-416) vulnerability in Mozilla Firefox. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked in the top 43.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the use-after-free vulnerability by requiring timely patching of affected Firefox and Thunderbird versions to fix the AudioIPC StreamData handling flaw.
Addresses malformed StreamData inputs over AudioIPC by enforcing validation in the Browser process to prevent triggering the use-after-free condition.
Provides memory protections such as ASLR and DEP to mitigate exploitation of the use-after-free in the Browser process following content process compromise.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free in browser process enables sandbox escape from compromised content process, directly facilitating client-side code execution (T1203), privilege escalation to browser process (T1068), and evasion of sandbox defenses (T1211).
NVD Description
On Windows, a compromised content process could use bad StreamData sent over AudioIPC to trigger a use-after-free in the Browser process. This could have led to a sandbox escape. This vulnerability was fixed in Firefox 136, Firefox ESR 115.21, Firefox…
more
ESR 128.8, Thunderbird 136, and Thunderbird 128.8.
Deeper analysisAI
CVE-2025-1930 is a use-after-free vulnerability (CWE-416) affecting the Browser process in Firefox and Thunderbird on Windows. It occurs when a compromised content process sends malformed StreamData over AudioIPC, triggering the use-after-free condition. The vulnerability impacts Firefox versions prior to 136, Firefox ESR prior to 115.21 and 128.8, Thunderbird prior to 136, and Thunderbird prior to 128.8. It carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
An attacker who first compromises a content process—such as through a separate renderer exploit—can send crafted AudioIPC StreamData to the Browser process, leading to a use-after-free. This enables a sandbox escape, allowing the attacker to execute code outside the content process sandbox with the privileges of the Browser process. Exploitation requires user interaction and is feasible over the network with low complexity and no privileges.
Mozilla addressed the issue in the specified fixed releases, as detailed in security advisories MFSA 2025-14 through MFSA 2025-17 and Bugzilla entry 1902309. Security practitioners should prioritize updating affected Firefox and Thunderbird installations on Windows to the patched versions to mitigate the risk of sandbox escape following content process compromise.
Details
- CWE(s)