Today’s Topics:
- Firefox Patches 2 Zero-Days Exploited at Pwn2Own Berlin with $100K in Rewards
- Microsoft Open-Sources Windows Subsystem for Linux at Build 2025
- How can Netizen help?
Firefox Patches 2 Zero-Days Exploited at Pwn2Own Berlin with $100K in Rewards
Mozilla has issued critical security updates to address two zero-day vulnerabilities found in its Firefox browser, which were actively exploited during the Pwn2Own Berlin hacking competition. These flaws, identified as CVE-2025-4918 and CVE-2025-4919, have the potential to allow attackers to execute arbitrary code or steal sensitive data. The vulnerabilities were demonstrated by ethical hackers, who were awarded $50,000 each for successfully exploiting the flaws in real-time
Vulnerabilities Overview:
The two vulnerabilities, both related to memory corruption and out-of-bounds access in Firefox’s JavaScript engine, were discovered by security researchers at Palo Alto Networks and credited to Edouard Bochin and Tao Yan for CVE-2025-4918, and Manfred Paul for CVE-2025-4919. Below are the technical details of each vulnerability:
- CVE-2025-4918 – Out-of-Bounds Access in Promise Objects:
This vulnerability stems from improper handling of Promise objects within Firefox’s JavaScript engine. By exploiting the flaw, an attacker can perform an out-of-bounds read or write operation, potentially leading to the exposure of sensitive information or triggering memory corruption. This could then allow an attacker to execute arbitrary code on the targeted system. - CVE-2025-4919 – Out-of-Bounds Access When Optimizing Linear Sums:
The second vulnerability, CVE-2025-4919, arises when Firefox optimizes linear sums in JavaScript objects. An attacker could leverage this flaw by causing incorrect array index calculations, leading to out-of-bounds memory access. Like the first vulnerability, this could allow unauthorized data access or memory corruption, potentially leading to code execution.
Both vulnerabilities were demonstrated at Pwn2Own Berlin, a renowned hacking contest where participants attempt to exploit real-world software. The successful exploits of these flaws earned the researchers a total of $100,000 in rewards. Notably, while these vulnerabilities were demonstrated in an attack setting, Mozilla has confirmed that both exploits were confined within Firefox’s sandbox environment. This means the flaws did not allow the attackers to escape the browser’s protective barriers and gain control over the underlying system.
Despite this, the risks associated with these vulnerabilities remain significant, especially considering the widespread use of web browsers as a primary vector for malware distribution. If successfully exploited, these flaws could allow attackers to access sensitive information, disrupt system operations, or potentially deliver malicious payloads.
The vulnerabilities affect several versions of the Firefox browser, including:
- All versions prior to Firefox 138.0.4 (including Firefox for Android).
- All versions of Firefox Extended Support Release (ESR) prior to 128.10.1 and 115.23.1.
Users are strongly urged to update to the latest Firefox release to mitigate the risk posed by these vulnerabilities.
Mozilla has emphasized that the vulnerabilities did not break out of the Firefox sandbox, a security feature designed to isolate browser processes from the underlying system. This containment effectively mitigated the potential impact of these exploits, as the attacker would not have been able to gain control of the operating system itself. Nonetheless, Mozilla has advised all users to update to the latest version of Firefox to ensure they are protected from these vulnerabilities.
As of now, Mozilla has released updated versions of Firefox that address both vulnerabilities. Users are encouraged to apply the patches immediately to avoid potential exploitation. Firefox users can download the latest update directly from the official Mozilla website or through their browser’s built-in update feature.
By staying informed and promptly applying patches, security teams can mitigate risks and protect their users from the exploitation of vulnerabilities like CVE-2025-4918 and CVE-2025-4919.
Microsoft Open-Sources Windows Subsystem for Linux at Build 2025
In a major move for the development community, Microsoft has officially open-sourced the Windows Subsystem for Linux (WSL), making its source code available on GitHub. This decision marks a significant milestone for a project that began as an experimental feature nearly a decade ago but has since evolved into one of the most popular tools for developers on Windows. While the move is a big step towards greater transparency and collaboration, certain components, such as the kernel driver and filesystem redirection elements, remain closed due to their integral role in Windows.
WSL was first introduced in 2016 at Microsoft’s BUILD conference and became a core feature of Windows 10 in the Anniversary Update. Initially, WSL 1 relied on a compatibility layer to bridge the gap between Linux and Windows, allowing Linux distributions to run directly within Windows without needing a full virtual machine.
The real game-changer came in 2019 with the release of WSL 2, which brought significant improvements. Instead of using a compatibility layer, WSL 2 now incorporates a full Linux kernel running in a lightweight virtual machine. This shift provided a wealth of performance benefits, including the ability to leverage GPU resources, support for systemd, and the ability to run graphical Linux applications seamlessly alongside Windows applications. These advancements made WSL an indispensable tool for developers working across both platforms.
With the open-source release at Build 2025, Microsoft has made the core components of WSL available for inspection and contribution. These include:
- Command-line tools:
wsl.exeandwslg.exe, which manage the WSL environment and the Linux graphical interface. - Background services: The
wslservice.exeservice responsible for managing the WSL lifecycle and its networking. - Linux-side daemons: Various background processes that handle networking, daemon launches, and port forwarding within the WSL environment.
By releasing these components, Microsoft is giving developers the ability to examine how WSL works at a deeper level, contribute to its evolution, and even build their own versions or features.
Pierre Boulay, a key figure behind WSL at Microsoft, shared that the decision to open-source WSL was driven by the contributions the community has already made without direct access to the source code. Over the years, many users have added valuable features and fixes to WSL through workarounds and community-driven patches. Microsoft now hopes that by allowing direct code contributions, the pace of innovation will accelerate even further.
“WSL could never have been what it is today without its community,” Boulay noted. “Even without access to WSL’s source code, people have been able to make major contributions that lead to what WSL is now. This is why we’re incredibly excited to open-source WSL today.”
While the core components of WSL have been made available, Microsoft has retained some proprietary elements that are integral to Windows. These include:
- Lxcore.sys: The kernel driver used in WSL 1, which is part of the Windows operating system.
- P9rdr.sys and p9np.dll: Components responsible for enabling the
\\wsl.localhostfilesystem redirection, a key feature of how WSL integrates with the Windows file system.
These components remain closed due to their direct involvement with Windows’ kernel and file system, making them too tightly coupled to the operating system’s core functionality to be open-sourced.
The open-sourcing of WSL offers several benefits to the developer community. Developers can now:
- Inspect the code: Gain insights into how WSL works under the hood and better understand its internals.
- Submit improvements: Propose new features, bug fixes, and optimizations, potentially improving WSL for all users.
- Build their own versions: Modify and build customized versions of WSL to suit specific use cases or enterprise environments.
With WSL now open for contributions, the possibility of accelerating the development of WSL features is high. Community contributions have always been at the heart of WSL’s evolution, and now Microsoft is formalizing that process, making it easier for anyone to get involved.
How Can Netizen Help?
Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time.
We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type.
Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.
Netizen is a CMMI V2.0 Level 3, ISO 9001:2015, and ISO 27001:2013 (Information Security Management) certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans.
