CVE-2025-10527 is a use-after-free vulnerability in the Graphics: Canvas2D component of Mozilla Firefox that enables sandbox escape. This memory safety flaw was present in Firefox ESR 140.2, Firefox 142, and Thunderbird ESR 140.2 and Thunderbird 142. The vulnerability was addressed and fixed in Firefox 143 and Firefox ESR 140.3, along with Thunderbird updates. The CVSS score is 7.1 (high), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability. Mozilla's official advisories confirm the fix and recommend updating to the patched versions.

Successful exploitation of this vulnerability could allow an attacker to escape the Firefox sandbox, potentially leading to arbitrary code execution with the privileges of the user running the browser. The vulnerability affects confidentiality, integrity, and availability of the affected system. However, no known exploits in the wild have been reported as of the advisory date.

Mozilla has released official fixes for this vulnerability in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird ESR 140.3. Users and administrators should update to these versions or later to remediate the issue. Since the vulnerability is fixed in these releases, no additional mitigation steps are required beyond applying the official updates.