CVE-2025-13025: Mozilla Firefox Use-After-Free Flaw

CVE-2025-13025 Overview

CVE-2025-13025 is a boundary condition vulnerability in the Graphics: WebGPU component of Mozilla Firefox and Thunderbird. The flaw allows a remote attacker to compromise integrity through a network attack vector without authentication or user interaction. Mozilla resolved the issue in Firefox 145 and Thunderbird 145. The vulnerability is documented under Mozilla Security Advisory MFSA-2025-87 and tracked in Mozilla Bug Report #1994022. The CWE classification is [CWE-276].

Critical Impact
Remote attackers can leverage incorrect boundary handling in WebGPU to compromise data integrity in the renderer process without user interaction.

Affected Products

Mozilla Firefox versions prior to 145
Mozilla Thunderbird versions prior to 145
Systems with WebGPU enabled in affected Mozilla builds

Discovery Timeline

2025-11-11 - CVE-2025-13025 published to NVD
2026-04-13 - Last updated in NVD database

Technical Details for CVE-2025-13025

Vulnerability Analysis

The vulnerability resides in the WebGPU implementation within the Mozilla graphics stack. WebGPU exposes low-level GPU access to web content through JavaScript APIs. Incorrect boundary conditions in this component mean that internal range checks fail to enforce the expected limits during GPU resource operations. An attacker delivering crafted WebGPU workloads through a malicious page can trigger this condition remotely. The integrity impact is rated high while confidentiality and availability are unaffected, suggesting the flaw enables manipulation of memory or state used by the renderer rather than disclosure or crashes.

Root Cause

The root cause is improper validation of size, offset, or index boundaries inside the WebGPU code path. When a boundary check is missing or incorrect, operations on GPU buffers or command encoders proceed against memory regions that should be off limits. Mozilla classified the bug under [CWE-276] in the NVD entry, though the descriptive text identifies it as a boundary condition error consistent with input validation defects in graphics code.

Attack Vector

Exploitation requires only that a victim visit a web page that executes attacker-controlled WebGPU code. No privileges and no user interaction beyond page navigation are required. In Thunderbird, the same code path is reachable through remote content rendering when scripting is enabled. The vulnerability manifests through the WebGPU API surface; see the Mozilla Security Advisory MFSA-2025-87 and Mozilla Bug Report #1994022 for technical detail on the affected code paths.

Detection Methods for CVE-2025-13025

Indicators of Compromise

Firefox or Thunderbird processes loading unexpected .wgsl shader content from untrusted origins
Renderer process anomalies such as unexpected child process spawns or memory growth following navigation to unknown domains
Browser telemetry showing WebGPU API calls from sites without legitimate graphics use cases

Detection Strategies

Inventory endpoints running Firefox or Thunderbird versions earlier than 145 using software asset management or EDR queries
Inspect HTTP traffic for sites delivering WebGPU compute shaders combined with large buffer allocations to unpatched clients
Correlate browser version data with crash telemetry and renderer sandbox escapes

Monitoring Recommendations

Alert on outdated Mozilla browser versions across managed endpoints
Monitor renderer child processes for anomalous behavior using behavioral AI from Singularity Endpoint
Forward browser and process telemetry into Singularity Data Lake for retrospective hunting against WebGPU exploitation patterns

How to Mitigate CVE-2025-13025

Immediate Actions Required

Update Firefox to version 145 or later on all managed endpoints
Update Thunderbird to version 145 or later, particularly where remote content rendering is enabled
Audit enterprise deployment channels (Firefox ESR, MSI distributions) to confirm patched builds are propagating

Patch Information

Mozilla shipped the fix in Firefox 145 and Thunderbird 145. Refer to the Mozilla Security Advisory MFSA-2025-87 and the related Mozilla Security Advisory MFSA-2025-90 for affected version ranges and release notes. Administrators using Firefox ESR should consult Mozilla guidance for the corresponding ESR release.

Workarounds

Disable WebGPU by setting dom.webgpu.enabled to false in about:config until patching is complete
Deploy enterprise policies that block WebGPU on managed Firefox installations
Restrict browsing to trusted sites through web filtering where immediate patching is not feasible

bash

# Configuration example: disable WebGPU via Firefox enterprise policy
# /etc/firefox/policies/policies.json
{
  "policies": {
    "Preferences": {
      "dom.webgpu.enabled": {
        "Value": false,
        "Status": "locked"
      }
    }
  }
}