CVE-2025-1936: Mozilla Firefox Path Traversal Vulnerability

CVE-2025-1936 Overview

CVE-2025-1936 affects Mozilla Firefox, Firefox ESR, and Thunderbird through a flaw in how jar: URLs handle null bytes when retrieving content from ZIP archives. The browser ignored the null byte and everything after it when reading archive content, but used the trailing fake extension to determine the content type. Attackers can leverage this inconsistency to disguise executable code inside web extensions that appear to be images or other benign file types. Mozilla resolved the issue in Firefox 136, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8.

Critical Impact
Malicious actors can smuggle executable web extension code behind benign-looking file extensions, bypassing content-type checks and enabling code execution within the browser's extension context.

Affected Products

Mozilla Firefox versions prior to 136
Mozilla Firefox ESR versions prior to 128.8
Mozilla Thunderbird versions prior to 136 and 128.8

Discovery Timeline

2025-03-04 - CVE-2025-1936 published to NVD
2026-04-13 - Last updated in NVD database

Technical Details for CVE-2025-1936

Vulnerability Analysis

The flaw is an improper neutralization of null bytes [CWE-158] in the jar: URL handler. The jar: scheme allows Firefox to address resources inside ZIP archives using the syntax jar:<url>!/<path-within-archive>. When the path component contained a null byte (\0), the archive retrieval logic truncated the string at that byte to locate the actual file. However, the MIME type resolver continued to read the full path, including the segment after the null.

This mismatch creates a parsing inconsistency. An attacker can package a JavaScript payload inside an archive, reference it with a path like script.js\0.png, and the browser will load the JavaScript content while treating it as an image. Web extensions can abuse this to hide active code within resources that appear inert to reviewers and content scanners.

Root Cause

The root cause is divergent string handling between two code paths that process the same input. The archive lookup uses C-style null-terminated string semantics, while the content-type sniffer uses the full byte-length string. Neither path validates that null bytes should be rejected as illegal in archive paths.

Attack Vector

Exploitation requires the victim to install or load a crafted web extension or visit a page that resolves a malicious jar: URL. The attack works over the network, requires no privileges, and needs no user interaction beyond the normal extension installation or page navigation flow. The technique is most useful for hiding malicious behavior from automated review pipelines that classify files by extension.

No verified public proof-of-concept code is available. See the Mozilla Bug Report #1940027 for technical discussion.

Detection Methods for CVE-2025-1936

Indicators of Compromise

Web extension packages (.xpi) containing files with null bytes (\0) embedded in resource path references
jar: URL strings in extension manifests or page content where the path segment includes encoded null characters such as %00
Mismatches between declared file extensions inside an archive and the actual byte signatures of those files

Detection Strategies

Inspect installed Firefox and Thunderbird extensions for archive entries whose internal paths contain null bytes or unusual extension suffixes appended after control characters
Monitor browser process telemetry for execution of script content loaded from resources advertised as non-script MIME types
Review proxy and endpoint logs for outbound requests to jar: URIs containing %00 sequences

Monitoring Recommendations

Track Firefox and Thunderbird version inventory across managed endpoints to confirm all instances are at or above the patched releases
Alert on installation events for unsigned or sideloaded extensions, which are the most likely delivery vehicle for this technique
Correlate extension installation events with subsequent unusual network connections or DOM modifications

How to Mitigate CVE-2025-1936

Immediate Actions Required

Update Firefox to version 136 or later on all managed endpoints
Update Firefox ESR to version 128.8 or later for long-term support deployments
Update Thunderbird to version 136 or version 128.8 or later
Audit currently installed browser extensions and remove any from untrusted publishers

Patch Information

Mozilla released fixes in Firefox 136, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8. Refer to the Mozilla Security Advisory MFSA-2025-14, MFSA-2025-16, MFSA-2025-17, and MFSA-2025-18 for vendor details. Debian users should apply updates per the Debian LTS Announcement March 2025.

Workarounds

Restrict web extension installation via enterprise policy using the ExtensionSettings group policy to allowlist only approved extensions
Disable third-party extension installation by setting xpinstall.enabled to false until patching is complete
Block jar: URL navigation at the network proxy layer where feasible

bash

# Enterprise policy example - restrict extensions via policies.json
# Place at: /etc/firefox/policies/policies.json (Linux)
# or: %ProgramFiles%\Mozilla Firefox\distribution\policies.json (Windows)
{
  "policies": {
    "ExtensionSettings": {
      "*": {
        "installation_mode": "blocked",
        "blocked_install_message": "Contact IT to request extension approval."
      }
    },
    "DisableAppUpdate": false
  }
}