VYPR
← All advisories
High severity7.5NVD Advisory· Published Mar 4, 2025· Updated Apr 13, 2026

CVE-2025-1931

CVE-2025-1931

Description

It was possible to cause a use-after-free in the content process side of a WebTransport connection, leading to a potentially exploitable crash. This vulnerability was fixed in Firefox 136, Firefox ESR 115.21, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A use-after-free in WebTransportChild::RecvRemoteClosed could be triggered, leading to a potentially exploitable crash in Firefox and Thunderbird.

Vulnerability

A use-after-free vulnerability exists in the content process side of a WebTransport connection, specifically in the WebTransportChild::RecvRemoteClosed handler. When a WebTransport connection is closed, the code could attempt to access memory that had already been freed, leading to a crash. This issue was discovered by security researcher sherkito and reported as Mozilla bug 1944126 [1].

Exploitation

To exploit this vulnerability, an attacker would need to establish a WebTransport connection with a target user and then trigger a race condition or specific sequence of events that causes the use-after-free. The attack could be carried out from a compromised content process or a specially crafted webpage. No authentication is required beyond the ability to establish a WebTransport connection [1][2].

Impact

If successfully exploited, this vulnerability could lead to a potentially exploitable crash of the content process. In the context of Firefox, this could allow an attacker to cause a denial of service or potentially execute arbitrary code within the content process. For Thunderbird, the advisory notes that many such flaws cannot be exploited through email because scripting is disabled when reading mail, but are potentially risks in browser-like contexts [3][4].

Mitigation

The vulnerability is fixed in Firefox 136, Firefox ESR 115.21, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8. Users should update their software to these versions or later to protect against this vulnerability [2][3][4].

References
  1. 1944126 - (CVE-2025-1931) heap-use-after-free in WebTransportChild::RecvRemoteClosed
  2. Security Vulnerabilities fixed in Firefox 136
  3. Security Vulnerabilities fixed in Thunderbird 136
  4. Security Vulnerabilities fixed in Thunderbird ESR 128.8

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

31

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

7

News mentions

0

No linked articles in our index yet.