CVE-2025-8028

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2025-8028 is a critical vulnerability in the WebAssembly (WASM) engine of Mozilla Firefox and Thunderbird browsers, specifically affecting arm64 architectures. The issue arises when processing a WASM `br_table` instruction with a large number of entries, causing the label distance from the instruction to exceed limits, resulting in truncation and incorrect computation of the branch target address. This flaw, classified under CWE-1332 (Incorrect Branch Target), impacts versions of Firefox prior to 141, Firefox ESR prior to 115.26, 128.13, and 140.1, as well as Thunderbird prior to 141, 128.13, and 140.1. It carries a CVSS v3.1 base score of 9.8, indicating high severity due to its potential for confidentially, integrity, and availability impacts.

A remote attacker can exploit this vulnerability without privileges or user interaction by tricking a victim into loading a malicious webpage containing specially crafted WASM code. On vulnerable arm64 systems running affected browser versions, the flawed branch computation enables arbitrary code execution within the browser's sandbox, potentially leading to full compromise of the user's system through escalation beyond the sandbox.

Mozilla's security advisories (MFSA 2025-56 through 59) and the associated Bugzilla entry confirm the vulnerability has been patched in the listed Firefox and Thunderbird versions. Security practitioners should prioritize updating affected browsers on arm64 platforms, such as Apple Silicon Macs or ARM-based Linux systems, to mitigate exploitation risks.