Pwn2Own 2025: Mozilla Patches Critical Firefox Vulnerabilities in Record Time

Mozilla has released urgent security updates for Firefox after two dangerous zero-day vulnerabilities were discovered during the Pwn2Own Berlin 2025 hacking competition. These updates were issued just hours after the flaws were demonstrated live on stage, showing Mozilla’s fast response to serious threats.

Pwn2Own Berlin 2025

Pwn2Own is a popular hacking contest where cybersecurity experts compete to find and demonstrate vulnerabilities in widely used software and devices. This year, the event was held in Berlin and included categories like web browsers, enterprise software, and virtualization platforms.

During the contest, two different zero-day vulnerabilities were successfully demonstrated in Mozilla Firefox. A zero-day vulnerability means the software vendor didn’t know about the flaw before it was exposed, and no fix was available at the time it was discovered.

Two Firefox Zero-Day Bugs

1. CVE-2025-4918 – JavaScript Engine Vulnerability
The first flaw is a memory issue found in Firefox’s JavaScript engine. It occurs when handling JavaScript “Promise” objects. Specifically, it allows out-of-bounds reading and writing in memory. This type of flaw can let attackers crash the browser or possibly run malicious code.

The vulnerability was demonstrated by cybersecurity researchers Edouard Bochin and Tao Yan from Palo Alto Networks. They successfully exploited it on the second day of the contest and were awarded $50,000 for their efforts.

2. CVE-2025-4919 – Array Index Confusion Bug
The second critical bug involves confusion around array index sizes, which can also lead to out-of-bounds memory access. In simple terms, attackers can trick the browser into reading or writing data where it shouldn’t, which can compromise the program’s security.

Security researcher Manfred Paul demonstrated this flaw and was also awarded $50,000 after gaining unauthorized access to Firefox’s internal renderer process.

Both vulnerabilities are rated “critical” by Mozilla due to their potential for serious exploitation. However, Mozilla noted that no sandbox escape was achieved during these demonstrations. A sandbox escape would allow attackers to break out of the browser’s protected environment and access the operating system, which could lead to full system compromise.

Mozilla stated that recent improvements to Firefox’s sandbox architecture were key in preventing such attacks. “Unlike previous years, no participating group managed to escape our sandbox this time,” Mozilla said in its official security advisory. They credited their new security enhancements for this success.

Mozilla’s Fast and Global Response

Although there is no evidence that these vulnerabilities have been used in real-world attacks, the public demonstration makes it possible that malicious hackers could now try to use them. That’s why Mozilla acted quickly.

As soon as the competition ended, Mozilla formed a global “task force” made up of security engineers and developers from different regions. This team worked around the clock to create, test, and release patches for the affected versions of Firefox.