CVE-2025-1010

CVE-2025-1010 is a high-severity use-after-free vulnerability affecting Mozilla Firefox versions prior to 135 and Firefox ESR prior to 115.20 and 128.7, as well as Thunderbird versions prior to 128.7 and 135. An unauthenticated attacker could exploit this flaw via the Custom Highlight API, potentially leading to a crash that could be exploited for arbitrary code execution. With a CVSS score of 8.8 (High), this vulnerability has a network attack vector, low attack complexity, and requires user interaction, but could result in high impacts to confidentiality, integrity, and availability. Its FAUCET Risk Score is 70/100, indicating significant risk. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. While it is not listed in CISA's KEV catalog, there has been some community discussion and media coverage, including an article from SecurityWeek.