CVE-2025-1936 is a vulnerability in Firefox versions prior to 136 and Firefox ESR prior to 128.8 involving jar: URLs that retrieve local file content packaged in a ZIP archive. The issue arises because the null character and everything after it are ignored when retrieving content from the archive, but the fake extension after the null is used to determine the content type. This behavior could allow code to be hidden in a web extension disguised as a different file type, such as an image.