CVE-2025-11710

This vulnerability (CWE-200: Information Exposure) exploits Mozilla's multi-process architecture, where web content runs in sandboxed child processes that communicate with the privileged parent browser process via Inter-Process Communication (IPC). The affected products (per CPE data: Mozilla Firefox standard and ESR branches, Mozilla Thunderbird) use Gecko engine's IPC framework to enforce security boundaries between untrusted web content and browser privileges. The flaw allows a compromised web content process-already executing attacker code due to a separate vulnerability-to craft malicious IPC messages that trick the parent process into disclosing chunks of its own memory. This breaks the sandbox containment model, exposing potentially sensitive data like passwords, cookies, encryption keys, or browsing history stored in parent process memory. The root cause classification as CWE-200 indicates improper validation of IPC message parameters, allowing out-of-bounds or unauthorized memory reads in the privileged context.