CVE-2025-0240 is a use-after-free vulnerability in Firefox caused by parsing a JavaScript module as JSON, which under certain conditions leads to cross-compartment access. This flaw affects Firefox versions prior to 134 and Firefox ESR versions prior to 128.6. The vulnerability has a moderate impact and does not involve confidentiality or availability loss but may allow limited integrity impact. Mozilla has fixed this issue in Firefox 134 and Firefox ESR 128.6.