PT-2025-9661 · Mozilla+11 · Firefox+11
Surya Dev Singh
·
Published
2025-03-04
·
Updated
2025-07-22
·
CVE-2025-1936
CVSS v3.1
7.3
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
Firefox versions prior to 136
Firefox ESR versions prior to 128.8
Description
The issue allows jar: URLs to retrieve local file content packaged in a ZIP archive. When retrieving content from the archive, anything after a null character is ignored, but a fake extension after the null can be used to determine the content type. This could be exploited to hide code in a web extension disguised as a different file type, such as an image.
Recommendations
For Firefox versions prior to 136, update to version 136 or later.
For Firefox ESR versions prior to 128.8, update to version 128.8 or later.
Fix
Improper Check for Exceptional Conditions
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Debian
Firefox
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu