CVE-2025-11719 is a critical severity (NVD score 9.8) use after free in the native messaging API for web extensions on Windows. Firefox 143 and Thunderbird 143 can crash. Mozilla fixed it in Firefox 144 and Thunderbird 144, and rates it moderate. Update both to 144 or later.
What's affected
The record lists Microsoft Windows, Mozilla Firefox and Mozilla Thunderbird. Mozilla says that starting in Firefox 143 and Thunderbird 143, the use of the native messaging API by web extensions on Windows could lead to crashes caused by use after free memory corruption. It is classed under CWE-416 (Use After Free).
The fix is in Firefox 144 and Thunderbird 144. Mozilla published the details in mfsa2025-81 for Firefox and mfsa2025-84 for Thunderbird, both announced on 14 October 2025.
Mozilla rates this item as moderate. The NVD score of 9.8 comes from the generic vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The practical condition, per the description, is a web extension that uses native messaging on Windows.
How to check if you're exposed
In Firefox, open the menu, choose Help, then About Firefox. In Thunderbird, open the menu, then Help, then About Thunderbird. Version 143 is the version named in the description, and 144 includes the fix.
On Windows fleets, you can list installed versions from the registry or your software inventory tool. A PowerShell query for Firefox looks like this:
Get-ItemProperty "HKLM:\Software\Mozilla\Mozilla Firefox" | Select-Object CurrentVersion
Then list the extensions that use native messaging, since they are the entry point. Inventory the extension names under about:addons, and ask whether each needs a native helper program. Exposure is lower where no installed extension uses native messaging.
What to do now
-
Update Firefox and Thunderbird to version 144 or later on every Windows machine.
-
Confirm the version through your software inventory, not just by asking users.
-
Review the extensions that use native messaging, and remove those that you do not need.
-
Restrict extension installation with Firefox enterprise policies where your organisation allows it.
-
Keep automatic updates enabled for both applications.
-
Note that Mozilla says in the Thunderbird advisory that scripting is disabled when reading mail, so these flaws generally cannot be exploited through email, but they matter in browser like contexts.
Why it matters
A use after free, tracked as CWE-416 (Use After Free), happens when a program keeps using memory after it was released. The result can be a crash, and in some cases corrupted memory that an attacker may steer. The description for this item mentions crashes, and Mozilla rates it moderate.
Browsers and mail clients are large programs with many memory handling paths, so Mozilla ships fixes for these classes in every release. The reliable defence is the boring one, a fast update cycle. Pair it with a tight extension policy, because extensions widen what a browser process touches.
The record does not mark the CVE as exploited in the CISA Known Exploited Vulnerabilities catalog, and the advisories I fetched do not report exploitation.
Quick check
Does this affect Mac or Linux?
The record and advisory describe the Windows build of the native messaging API. The record lists Microsoft Windows as the platform.
Can this be reached through email in Thunderbird?
Mozilla says scripting is disabled when reading mail, so these flaws generally cannot be exploited through email. They are possible risks in browser like contexts.
Sources
- CVE-2025-11719 on Safeguard Gold
- NVD record for CVE-2025-11719
- Mozilla Foundation Security Advisory 2025-81 (Firefox)
- Mozilla Foundation Security Advisory 2025-84 (Thunderbird)
Last reviewed: 19 October 2026.
