On arm64, a WASM `br_table` instruction with a lot of entries could lead to the label being too far from the instruction causing truncation and incorrect computation of the branch address. This vulnerability affects Firefox < 141, Firefox ESR < 115.26, Firefox ESR < 128.13, Firefox ESR < 140.1, Thunderbird < 141, Thunderbird < 128.13, and Thunderbird < 140.1.
The device is missing or incorrectly implements circuitry or sensors that detect and mitigate the skipping of security-critical CPU instructions when they occur.
| Link | Tags |
|---|---|
| https://bugzilla.mozilla.org/show_bug.cgi?id=1971581 | permissions required |
| https://www.mozilla.org/security/advisories/mfsa2025-56/ | vendor advisory |
| https://www.mozilla.org/security/advisories/mfsa2025-57/ | vendor advisory |
| https://www.mozilla.org/security/advisories/mfsa2025-58/ | vendor advisory |
| https://www.mozilla.org/security/advisories/mfsa2025-59/ | vendor advisory |
| https://www.mozilla.org/security/advisories/mfsa2025-61/ | vendor advisory |
| https://www.mozilla.org/security/advisories/mfsa2025-62/ | vendor advisory |
| https://www.mozilla.org/security/advisories/mfsa2025-63/ | vendor advisory |