CVE-2025-0240 is a memory safety vulnerability in Mozilla Firefox where parsing a JavaScript module as JSON can cause cross-compartment access, resulting in a use-after-free condition. This flaw could potentially lead to integrity issues within the browser's execution environment. The vulnerability was fixed in Firefox 134 and Firefox ESR 128.6 as part of a broader security update addressing multiple memory safety bugs. The CVSS 3.1 base score is 4.0 with vector AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, indicating local attack vector with low complexity and no privileges or user interaction required.

The vulnerability may allow an attacker with local access to cause a use-after-free condition, potentially leading to integrity violations within the browser process. There is no direct impact on confidentiality or availability according to the CVSS vector. No known exploits have been reported in the wild, reducing immediate risk. The fix in Firefox 134 and ESR 128.6 mitigates this issue.

Users and administrators should update Mozilla Firefox to version 134 or later, or Firefox ESR to version 128.6 or later, where this vulnerability is fixed. Since the vendor advisory confirms an official fix is available, applying these updates is the recommended remediation. No additional mitigation steps are indicated by the vendor advisory.