CVE-2025-1010 is a use-after-free vulnerability identified in the Custom Highlight API of Mozilla Firefox. This flaw allows an attacker to trigger a use-after-free condition, potentially causing a crash that could be exploited to execute arbitrary code. The vulnerability has a CVSS 3.1 base score of 9.8, indicating critical severity with network attack vector, no privileges required, and no user interaction needed. Mozilla fixed this vulnerability in Firefox 135 and related ESR and Thunderbird versions. The vendor advisory details the fix and confirms the vulnerability's high impact.

The vulnerability enables an attacker to cause a use-after-free condition via the Custom Highlight API, leading to memory corruption and a potentially exploitable crash. This could result in arbitrary code execution with high impact on confidentiality, integrity, and availability. The CVSS score of 9.8 reflects the critical nature of this issue. No known active exploits have been reported, but the risk is significant if unpatched.

Mozilla has released official fixes for this vulnerability in Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135. Users and administrators should update to these versions or later to remediate the issue. Since the vulnerability is patched, no additional mitigation steps are required beyond applying the official updates.