CVE-2025-1936: Mozilla Firefox Path Traversal Vulnerability

CVE-2025-1936 Overview

CVE-2025-1936 is an Improper Handling of Null Byte Input vulnerability (CWE-158) affecting Mozilla Firefox and Thunderbird. The flaw exists in how jar: URLs process file paths containing null bytes when retrieving content from ZIP archives. When a null byte is present in the URL path, everything after it is ignored during content retrieval, but the fake extension following the null byte is still used to determine the content type. This creates a dangerous disconnect between the actual content being served and how the browser interprets it.

This vulnerability could enable attackers to disguise malicious code within web extensions by making executable content appear as benign file types like images. The flaw allows bypassing content-type verification mechanisms, potentially enabling code execution within browser or email client contexts.

Critical Impact

Attackers can leverage this null byte injection in jar: URLs to disguise malicious code as innocent file types within web extensions, potentially bypassing security controls and enabling hidden code execution in Firefox and Thunderbird.

Affected Products

• Mozilla Firefox versions prior to 136
• Mozilla Firefox ESR versions prior to 128.8
• Mozilla Thunderbird versions prior to 136 and 128.8

Discovery Timeline

• March 4, 2025 - CVE-2025-1936 published to NVD
• April 13, 2026 - Last updated in NVD database

Technical Details for CVE-2025-1936

Vulnerability Analysis

The vulnerability stems from improper handling of null byte characters in jar: URL paths. The jar: protocol is designed to access content within JAR (Java Archive) and ZIP files directly from URLs. When processing these URLs, Mozilla applications exhibited inconsistent behavior when encountering null bytes (\\x00) embedded within file path components.

The core issue involves a type confusion scenario where the content retrieval mechanism and the content-type determination mechanism process the same URL differently. The content retrieval system truncates the path at the null byte, loading the actual file content before that point. However, the MIME type detection logic reads past the null byte, using the trailing extension to classify the content type.

For example, a URL like jar:file.zip!/malicious.js\\x00.png would load the JavaScript file malicious.js but classify it as an image based on the .png extension. This allows web extensions to embed executable code that appears to be static content, effectively hiding functionality from both automated scanners and manual code review.

Root Cause

The root cause is improper handling of null byte input (CWE-158) within the JAR URL parsing logic. The null byte character serves as a string terminator in C-style string handling, but different components of the URL processing pipeline interpret it inconsistently. One subsystem truncates at the null byte while another reads through it, creating a type confusion vulnerability. This inconsistency allows attackers to craft URLs where the apparent file type differs from the actual content being loaded.

Attack Vector

The attack vector is network-based and requires no user interaction or special privileges. An attacker could exploit this vulnerability through several methods:

1. Malicious Web Extension: Creating a browser extension that packages hidden executable code disguised as images or other static assets
2. Drive-by Extension Installation: Social engineering users into installing seemingly benign extensions with hidden functionality
3. Supply Chain Attacks: Compromising legitimate extension update mechanisms to inject hidden code

The exploitation mechanism involves crafting a jar: URL containing a null byte that separates the actual resource path from a fake extension. When the browser loads content from a web extension's ZIP-packaged resources, the null byte causes the actual content to be retrieved while the content-type is determined by the misleading extension suffix.

Detection Methods for CVE-2025-1936

Indicators of Compromise

• Presence of web extensions containing files with unexpected null bytes in their internal paths
• Browser extension resources where the file content does not match the declared MIME type
• Unusual jar: URL requests in network logs or browser developer tools containing encoded null characters (%00)
• Web extensions with image files that contain JavaScript or executable content signatures

Detection Strategies

• Monitor for browser extensions with ZIP archive entries containing null byte characters in file names or paths
• Implement content-type validation that compares actual file signatures (magic bytes) against declared MIME types
• Deploy endpoint detection rules to identify processes loading suspicious web extension resources
• Analyze installed browser extensions for mismatched content-type declarations versus actual file content

Monitoring Recommendations

• Enable verbose logging for browser extension installations and updates to capture extension manifest analysis
• Deploy SentinelOne Singularity Platform to detect anomalous browser behavior and extension-based threats
• Implement network monitoring to identify suspicious jar: URL patterns in HTTP traffic
• Regularly audit installed browser extensions across enterprise endpoints using endpoint management tools

How to Mitigate CVE-2025-1936

Immediate Actions Required

• Update Mozilla Firefox to version 136 or later immediately
• Update Mozilla Firefox ESR to version 128.8 or later
• Update Mozilla Thunderbird to version 136 or 128.8 or later
• Audit currently installed browser extensions for potentially suspicious content
• Review extension installation policies to restrict unauthorized extension sources

Patch Information

Mozilla has released security patches addressing this vulnerability in Firefox 136, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8. The patches correct the null byte handling in jar: URL parsing to ensure consistent behavior across content retrieval and type determination. Detailed information is available in the following Mozilla Security Advisories:

• Mozilla Security Advisory MFSA-2025-14
• Mozilla Security Advisory MFSA-2025-16
• Mozilla Security Advisory MFSA-2025-17
• Mozilla Security Advisory MFSA-2025-18

Additional technical details can be found in Mozilla Bug Report #1940027. Debian users should also reference the Debian LTS Announcement for distribution-specific updates.

Workarounds

• Restrict web extension installations to only trusted sources and approved extensions via enterprise policy
• Implement browser security policies that limit extension permissions and access to local resources
• Consider disabling jar: URL support if not required for business operations
• Deploy application allowlisting to prevent execution of unauthorized browser extension code
• Use SentinelOne's application control features to monitor and restrict browser extension behavior