Starting in Firefox and Thunderbird 143, the use of the native messaging API by web extensions on Windows could lead to use-after-free memory corruption, causing application crashes. This vulnerability (CVE-2025-11719) was addressed and fixed in Firefox 144 and Thunderbird 144. The issue is classified under CWE-416 (Use After Free) and has a CVSS v3.1 base score of 9.8, reflecting its critical severity with network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vendor advisory confirms the fix and recommends updating to version 144 or later.

Successful exploitation of this vulnerability could cause crashes in Firefox or Thunderbird on Windows due to use-after-free memory corruption. The CVSS score of 9.8 indicates that the vulnerability could potentially allow an attacker to execute arbitrary code or cause denial of service, impacting confidentiality, integrity, and availability. However, no known exploits are reported in the wild. The vulnerability affects users running versions 143 of Firefox or Thunderbird on Windows platforms.

Mozilla has released official fixes for this vulnerability in Firefox 144 and Thunderbird 144. Users and administrators should update affected products to version 144 or later to remediate this issue. Since the vulnerability is patched, no additional mitigation steps are required beyond applying the official updates.