CVE-2025-4083 is a high-impact process isolation bypass vulnerability in Mozilla Firefox and Thunderbird. It arises from improper handling of javascript: URI links in cross-origin frames, which can cause content to execute in the top-level document's process instead of the isolated frame. This behavior undermines the sandboxing mechanism designed to contain potentially malicious content, thereby enabling a sandbox escape. The vulnerability affects multiple Mozilla products and was addressed in Firefox 138, Firefox ESR 128.10, Thunderbird 138, and Thunderbird 128.10. The vulnerability has a CVSS v3.1 base score of 9.1, reflecting its critical nature. The vendor advisory provides detailed information and confirms that patches have been released.

Successful exploitation of this vulnerability could allow an attacker to bypass process isolation and execute code in the top-level document's process, potentially escaping the sandbox environment. This could lead to unauthorized code execution with the privileges of the browser process, posing a significant security risk. However, there are no reports of active exploitation in the wild at the time of the advisory.

Official patches addressing this vulnerability are available in Firefox 138, Firefox ESR 128.10, Thunderbird 138, and Thunderbird 128.10. Users and administrators should update to these versions or later to mitigate the risk. Since this is not a cloud service, remediation depends on applying these updates. No additional vendor-recommended mitigations or workarounds are indicated in the advisory.