CVE-2025-10528: 
NixOS vulnerability analysis and mitigation

CVE-2025-10528 is a sandbox escape vulnerability caused by undefined behavior and an invalid pointer in Firefox's Graphics: Canvas2D component. It was discovered by external researcher Oskar L and disclosed on September 16, 2025, alongside a related Canvas2D sandbox escape (CVE-2025-10527). Affected products include Firefox versions prior to 143, Firefox ESR versions prior to 140.3, Thunderbird versions prior to 143, and Thunderbird ESR versions prior to 140.3. The vulnerability carries a CVSS v3.1 base score of 7.3 (High) (Mozilla Advisory Firefox 143, Mozilla Advisory Firefox ESR 140.3, Mozilla Advisory Thunderbird 140.3).

The root cause is an access of an uninitialized/invalid pointer (CWE-824) combined with a protection mechanism failure (CWE-693) in the CanvasTranslator::NextBuffer() function within gfx/layers/ipc/CanvasTranslator.cpp. When the remote Canvas actor processes a RecordedDropBuffer event, it calls mCanvasShmems.front() and mCanvasShmems.pop() on the shared memory queue without first verifying the queue is non-empty, resulting in undefined behavior — specifically a heap buffer overflow (both read and write) on the mCurrentShmem object. This occurs in the compositor (GPU or Browser) process, which receives canvas events from the content process via read-only shared memory, meaning a compromised content process can trigger the bug in a more privileged process. The bug was introduced by regression bug 1863914 and affects Firefox 122 and later. A proof-of-concept patch and reproduction steps were provided by the reporter in the Mozilla bug tracker (Mozilla Bugzilla).

Successful exploitation allows a compromised content process to escape the Firefox sandbox and potentially compromise the GPU or parent (browser) process, which operates with higher privileges. The heap buffer overflow on the mCurrentShmem shared memory object could be leveraged to unmap shared memory regions used by other processes, creating a use-after-free condition that may enable interference with inter-process communication (IPC) channels. This could lead to unauthorized code execution in a privileged process context, with confidentiality, integrity, and availability all at risk (Mozilla Bugzilla, Mozilla Advisory Firefox 143).

No public proof-of-concept exploit code is known to exist beyond the researcher's patch-based reproduction steps shared in the Mozilla bug tracker, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to first compromise the content process (e.g., via a separate browser vulnerability) before leveraging this bug to escape the sandbox, raising the overall exploitation complexity (Mozilla Bugzilla, Feedly).

1. Compromise the content process: Exploit a separate vulnerability (e.g., a JavaScript engine bug) to achieve code execution within Firefox's sandboxed content process.
2. Enable remote canvas: Ensure the remote canvas feature is active (enabled by default on supported platforms; on some platforms like VMs it may need to be forced via gfxVars::SetRemoteCanvasEnabled(true)).
3. Initialize canvas with malicious buffers: From the content process, use the OffscreenCanvas API (e.g., via a Web Worker with transferControlToOffscreen) to initialize the Canvas actor and send shared memory buffers pre-filled with DROP_BUFFER events to the compositor.
4. Trigger RecordedDropBuffer events: Send two or more RecordedDropBuffer events via the canvas IPC channel, causing CanvasTranslator::NextBuffer() in the compositor process to call front() and pop() on an empty mCanvasShmems queue.
5. Exploit undefined behavior: The empty queue access produces undefined behavior, placing an invalid/unpredictable value in the mCurrentShmem handle, resulting in a heap buffer overflow in the compositor (GPU or parent) process.
6. Achieve sandbox escape: Leverage the corrupted shared memory handle to unmap memory regions used by other processes, potentially creating a use-after-free condition that can be further exploited to execute arbitrary code in the privileged compositor process (Mozilla Bugzilla).

Mozilla has released patches addressing this vulnerability in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird ESR 140.3, all announced on September 16, 2025. Users and administrators should update to these versions or later immediately. No configuration-based workaround is available; upgrading is the only remediation. Enterprise deployments should also apply vendor-specific patches from Red Hat (RHSA-2025:16108, RHSA-2025:16109, RHSA-2025:16156, RHSA-2025:16157, and others), Debian (DSA-6003-1), openSUSE, Slackware, and Amazon Linux as applicable (Mozilla Advisory Firefox 143, Mozilla Advisory Firefox ESR 140.3, Mozilla Advisory Thunderbird 140.3).

The Center for Internet Security (CIS) issued an advisory noting that multiple vulnerabilities in Mozilla products fixed in this release could allow for arbitrary code execution (CIS Advisory). The vulnerability received a security bounty from Mozilla, indicating it was assessed as a meaningful security risk by the Mozilla security team. Community and media coverage noted the release of Firefox 143 as a significant security update, with the Canvas2D sandbox escapes (CVE-2025-10527 and CVE-2025-10528) highlighted as the most severe issues addressed (Mozilla Bugzilla).