EUVD-2025-18102
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
A vulnerability in Mozilla VPN on macOS allows privilege escalation from a normal user to root. *This bug only affects Mozilla VPN on macOS. Other operating systems are unaffected.* This vulnerability affects Mozilla VPN 2.28.0 < (macOS).
Analysis
Local privilege escalation vulnerability in Mozilla VPN for macOS that allows an authenticated local user to escalate privileges from normal user to root. This affects Mozilla VPN versions below 2.28.0 on macOS exclusively. An attacker with local access can exploit this without user interaction to gain complete system control, making it a critical risk for multi-user systems or compromised local accounts.
Technical Context
The vulnerability stems from an improper privilege management flaw (CWE-269: Improper Access Control) within Mozilla VPN's macOS implementation. CWE-269 encompasses failures in authorization logic where system components fail to properly validate or enforce privilege boundaries before executing sensitive operations. Mozilla VPN on macOS likely uses system-level network extensions or helper processes that run with elevated privileges; the vulnerability suggests that the VPN client fails to properly validate the calling user's permissions before executing root-level operations. This could manifest as an unprotected IPC mechanism, unsafe file operations with improper permission checks, or direct invocation of privileged helper tools without adequate authentication. The macOS-specific nature indicates platform-specific kernel APIs or system frameworks (possibly Network Extension framework or similar) are involved. CPE affected: `cpe:2.4:a:mozilla:mozilla_vpn:*:*:*:*:*:macos:*` with version range < 2.28.0.
Affected Products
Mozilla VPN (< 2.28.0)
Remediation
Upgrade Mozilla VPN to version 2.28.0 or later on macOS; priority: Critical; details: Users should update immediately via the App Store or Mozilla's official download page. Mozilla VPN typically auto-updates on macOS, but users should verify they are on version 2.28.0+ Workaround: Until patched, restrict local system access and disable Mozilla VPN on shared or untrusted systems; priority: High; details: Disable or uninstall Mozilla VPN on multi-user macOS systems until patch is applied. Use alternative VPN solutions if Mozilla VPN is essential. Ensure user accounts are password-protected and strong; monitor for unauthorized local access. Detection: Monitor for unusual root-level process spawning or privilege escalation attempts from VPN processes; priority: Medium; details: EDR/MDM tools should flag suspicious helper process invocations or IPC calls from com.mozilla.macos.FirefoxVPN or related bundles
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today