CVE-2023-25747 Use after free in Firefox for Android

What is CVE-2023-25747?

CVE-2023-25747 is a high-severity use after free vulnerability in Mozilla Firefox Mobile, published on 19 Jun 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A potential use-after-free in libaudio was fixed by disabling the AAudio backend when running on Android API below version 30. *This bug only affects Firefox for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox for Android < 110.1.0.

Weakness: CWE-416

Which versions are affected by CVE-2023-25747?

It affects 1 product.

Products include Mozilla Firefox Mobile.

How do I fix CVE-2023-25747?

No fix has been published for CVE-2023-25747 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2023-25747 being exploited?

There is no known exploitation of CVE-2023-25747 in the wild and no public exploit code.

Other vulnerabilities in Mozilla Firefox Mobile

• CVE-2026-84135 Other issue in Firefox Focus for Android Critical 9.8
• CVE-2024-43111 Cross-site scripting in Firefox for iOS Critical 9.8
• CVE-2023-49060 Information disclosure in Firefox for iOS Critical 9.8
• CVE-2026-92033 Privilege escalation in Firefox for Android High 8.8
• CVE-2026-84117 Privilege escalation in Firefox for Android High 8.8

All Mozilla Firefox Mobile vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-q7rv-ch5x-wprg.