Skip to content
Skip to main content
header search
CompileHub
Menu
sticky search

Mozilla Firefox 138.0.4 fixes two critical security issues in the browser (ESR affected as well)

Mozilla released a critical security update for its open source Firefox web browser that addresses two security issues used during the Pwn2Own Berlin 2025 security event to exploit the browser.

The details:

  • The two security issues have a severity rating of critical.
  • They were successfully exploited during the 2025 Berlin Pwn2Own event.
  • Updates are available for Firefox Stable and Firefox ESR.

Firefox users who run the stable version of  the web browser are encouraged to install the update to Firefox 138.0.4 as soon as possible to protect their data from potential attacks targeting the vulnerability. Considering that the exploits have been demonstrated successfully during the event, it is possible that malware actors will replicate them.

Both Firefox ESR, extended support release, versions are also affected. Mozilla maintains two ESR branches at the moment, one older operating systems such as Windows 7 and the other for current operating systems, such as Windows 10 and 11.

Most Firefox installations should install the update automatically. Firefox users may speed up the installation by selecting Menu  > Help > About Firefox. This should download and install the update on desktop operating systems immediately.

Here is the list of Firefox versions after the installation of the update:

  • Firefox Stable: 138.0.4
  • Firefox 115 ESR: 115.23.1
  • Firefox 128 ESR: 128.10.1

Two critical security issues in Firefox

Mozilla lists the two fixed security issues on the official security advisory website of the Firefox web browser. Both have a critical severity rating, which is the highest rating available.

  • CVE-2025-4920: Out-of-bounds access when resolving Promise objects -- An attacker was able to perform an out-of-bounds read or write on a JavaScript Promise object.
  • CVE-2025-4921: Out-of-bounds access when optimizing linear sums -- An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index sizes.

The next major release of the Firefox web browser is Firefox 139 Stable. Firefox 115.24 ESR and Firefox 128.11 ESR will also be released on the same day.

Now You: how do you handle updates of your favorite browser?

More exciting content