CVE-2025-10528 is a sandbox escape vulnerability caused by undefined behavior related to an invalid pointer in the Graphics: Canvas2D component of Mozilla Firefox. This memory safety bug could potentially allow an attacker to break out of the browser's sandbox environment. The issue was addressed and fixed in Firefox 143 and Firefox ESR 140.3. The vulnerability carries a CVSS 3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to escape the Firefox sandbox, potentially leading to arbitrary code execution or other malicious actions outside the browser's restricted environment. The impact is rated high due to the ability to compromise browser security boundaries. However, there are no known exploits in the wild currently.

This vulnerability has been fixed by Mozilla in Firefox 143 and Firefox ESR 140.3. Users and administrators should update their Firefox and Firefox ESR installations to these versions or later to remediate the issue. No additional mitigation steps are required beyond applying the official update.