CVE-2025-11710 is a high-impact information disclosure vulnerability in Mozilla Firefox caused by malicious IPC messages from a compromised web process. This flaw could lead the privileged browser process to reveal blocks of its memory to the attacker-controlled process. The issue was addressed in Firefox 144 and corresponding ESR and Thunderbird versions. The vulnerability is part of a set of critical security fixes released by Mozilla on October 14, 2025. The CVSS v3.1 base score is 9.8, reflecting network attack vector, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability. The vendor advisory confirms the fix and recommends updating to the patched versions.

Successful exploitation of this vulnerability could result in unauthorized disclosure of sensitive memory contents from the privileged browser process to a compromised web process. This could lead to exposure of sensitive data, potentially including user information or browser internals. The CVSS score of 9.8 indicates critical severity with high impact on confidentiality, integrity, and availability. No known active exploits have been reported at the time of the advisory.

Mozilla has released official fixes for this vulnerability in Firefox 144, Firefox ESR 115.29, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4. Users and administrators should promptly update to these versions or later to mitigate the risk. Since this is not a cloud service, remediation depends on applying the vendor's patches. Patch status is confirmed as fixed by Mozilla's official security advisories. No additional mitigation steps are indicated beyond applying the updates.