External risk intelligence

Thunderbird Firefox Native Messaging Use-After-Free Vulnerability CVE-2025-11719

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-11719

This vulnerability exists within the native messaging API implementation of client-side desktop applications (Firefox and Thunderbird). It requires the execution of specific web extensions on a local end-user machine. As a client-side software issue rather than a public-facing service, API, or internet gateway, it is not reachable from the public internet.

Use After Free

Mozilla Firefox

143.0 to before 144.0

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in how web extensions communicate with certain versions of Firefox and Thunderbird on Windows could allow for crashes due to memory corruption. This issue has been addressed in later versions.

Web extensions can crash software.
Affects software used for email and browsing.
Confirm if this software is in use.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by convincing a user to install a malicious web extension that utilizes the native messaging API within specific versions of Thunderbird on Windows. If successful, this could lead to a crash due to memory corruption, potentially allowing for further malicious actions if the attacker can leverage the crash.

Requires user to install malicious extension.
Triggers use-after-free in messaging API.
Can lead to application crashes.

Live Threat

Current exploitation, exposure, and threat context

On Windows, web extensions using the native messaging API in affected versions of Thunderbird could experience crashes due to use-after-free memory corruption when the API is called.

Thunderbird application stability.
Malicious web extensions could trigger crashes.
Application crashes could disrupt user workflow.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects client-side desktop applications, specifically Firefox and Thunderbird on Windows, when using web extensions with the native messaging API. The primary responsibility for addressing this likely falls to endpoint or device management teams, potentially in coordination with application owners or IT support, to identify affected users and plan for the deployment of updated application versions. The first practical step is to determine the scope of affected deployments and confirm if any business-critical systems are impacted.

Identify and track affected endpoints.
Verify user exposure and business impact.
Plan deployment of updated application versions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Thunderbird and Firefox native messaging API?

This API allows web extensions to exchange data with software installed on your Windows computer, extending browser capabilities beyond basic web tasks. Thunderbird and Firefox use this component to securely facilitate communication between browser-based add-ons and local system applications.

What does CVE-2025-11719 mean for memory safety?

This vulnerability is classified as a use-after-free weakness (CWE-416). It occurs when the software continues to use a memory location after it has been cleared, causing unexpected instability. In CVE-2025-11719, this memory corruption error can lead to immediate application crashes when the native messaging API processes specific commands.

How is this memory corruption triggered?

The issue is triggered when a user executes a specific web extension that interacts with the native messaging API on Windows. It is not triggered by standard web browsing or routine email use; the software must be processing an interaction from a malicious or flawed web extension to encounter the faulty memory state.

Why should I care about this if my apps are internal?

According to Halo Surface Signal, this vulnerability affects local, client-side software rather than public-facing servers. Because it requires the local execution of an extension on an end-user machine, it is not reachable from the public internet. However, users of affected Windows versions remain vulnerable to local extension-based risks.

How do I secure my systems against this CVE?

The primary response is to update your software to version 144 or later. Since this issue resides in client-side applications, your first step is to identify all endpoints running versions 143 of Firefox or Thunderbird on Windows and schedule the deployment of the provided security updates to resolve the underlying memory flaw.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.