CVE-2025-8028: 
NixOS vulnerability analysis and mitigation

CVE-2025-8028 is a WebAssembly branch table truncation vulnerability in Mozilla Firefox and Thunderbird on arm64 architectures, titled "Large branch table could lead to truncated instruction." When a WASM br_table instruction contains an excessive number of entries (previously up to 1 million), the target label can be placed too far from the adr instruction, causing the 21-bit PC-relative offset to be truncated and resulting in incorrect computation of the branch address. The vulnerability was discovered by Gary Kwong via fuzzing and disclosed on July 22, 2025. Affected products include Firefox < 141, Firefox ESR < 115.26, Firefox ESR < 128.13, Firefox ESR < 140.1, Thunderbird < 141, Thunderbird < 128.13, and Thunderbird < 140.1. It carries a CVSS v3.1 base score of 9.8 (Critical) (Mozilla Advisory, Feedly).

The root cause is classified as CWE-1332 (Improper Handling of Faults that Lead to Instruction Skips). On arm64, Firefox's WASM baseline compiler uses the Adr instruction to load the address of a jump table for br_table dispatch. When the number of entries is large enough (>~65,520), the jump table label exceeds the 21-bit signed range of the Adr instruction; in release builds, the offset is silently truncated rather than triggering an assertion, causing the computed address to point into an incorrect location in JIT code. An attacker can craft a WASM module with a br_table containing more than ~65,520 entries and additional functions to place desired constants in JIT code, then manipulate the truncated address to load an attacker-controlled code pointer and redirect execution. The fix aligns Firefox's br_table entry limit with Chrome/V8's limit of 65,520 (Mozilla Bugzilla, Mozilla Advisory).

Successful exploitation could allow an attacker to achieve remote code execution within the Firefox or Thunderbird content process on arm64 devices. By controlling the truncated branch destination, an attacker may redirect execution to attacker-controlled JIT code, potentially enabling full compromise of the browser sandbox, information disclosure, or denial of service. The vulnerability affects all arm64 platforms running vulnerable versions, including Android devices running Firefox, and has high impacts on confidentiality, integrity, and availability (Mozilla Bugzilla, Mozilla Advisory).

No public proof-of-concept exploit or in-the-wild exploitation has been reported as of the disclosure date. Mozilla's internal assessment rated exploit construction as "moderately difficult for a knowledgeable attacker," noting that an attacker would need to craft a WASM module with a very large br_table, embed desired code pointers in other WASM functions' JIT output, and potentially leak a code address. The EPSS score is 0.024% (very low probability of near-term exploitation). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. It was awarded a Mozilla security bug bounty (Mozilla Bugzilla, Feedly).

1. Craft a malicious WASM module: Create a WebAssembly module containing a br_table instruction with more than ~65,520 entries (Firefox's previous limit was 1 million), which causes the jump table label to exceed the 21-bit range of the arm64 Adr instruction.
2. Embed target code pointers: Add additional WASM functions to the module that, when JIT-compiled, place attacker-controlled constants (desired code pointers) into the JIT code region adjacent to the jump table.
3. Calculate truncation offset: Determine the exact number of br_table entries and the jump index needed so that the truncated Adr offset resolves to the location in JIT memory containing the attacker's embedded code pointer.
4. Trigger execution: Deliver the malicious WASM module to a victim running a vulnerable arm64 Firefox or Thunderbird (e.g., via a malicious web page or HTML email), causing the br_table dispatch to load the attacker's code pointer from the jump table.
5. Achieve code execution: The Br instruction jumps to the attacker-controlled address, redirecting execution within the content process and potentially enabling sandbox escape or further exploitation (Mozilla Bugzilla).

Mozilla has released patched versions addressing this vulnerability: Firefox 141, Firefox ESR 115.26, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1. The fix lowers the maximum allowed number of br_table entries to match Chrome/V8's limit of 65,520, preventing the offset truncation condition. Organizations unable to update immediately should consider temporarily disabling WebAssembly execution where feasible, or prioritizing patching of arm64 systems (including Android devices). Upgrading to a patched version is the recommended and only definitive remediation (Mozilla Advisory, Mozilla Advisory ESR 128, Mozilla Advisory ESR 140).

The vulnerability was reported by external fuzzer Gary Kwong and received a Mozilla security bug bounty. Security news outlets including GBHackers, CyberSecurityNews, and CyberPress covered the Firefox 141 release, highlighting the critical security fixes. Red Hat, Debian, SUSE, Oracle Linux, Amazon Linux, and openSUSE all issued downstream advisories and updated packages shortly after Mozilla's disclosure. The community response focused on the urgency of patching arm64 systems, particularly Android devices running Firefox (Mozilla Advisory, Mozilla Bugzilla).