Manfred Paul Demonstrates Firefox JIT Exploit at Pwn2Own Berlin 2025
· 20:14 · Watch on YouTube ↗
Summary
At Pwn2Own Berlin 2025, Manfred Paul demonstrated a Firefox JIT optimization bug. Incorrect bounds-check elimination after 32-bit integer wraparound enabled out-of-bounds memory access; opening a web page triggered browser code execution. Mozilla received the disclosure
Key points
- Manfred Paul demonstrated a Firefox exploit at Pwn2Own Berlin 2025: visiting a web page triggered browser code execution without additional clicks.
- The bug involved Firefox JIT bounds-check elimination merging checks and removing one that was still required, enabling out-of-bounds memory access.
- A JavaScript bitwise OR with 0 forced signed 32-bit truncation; after optimization removed that operation, the bounds analysis mishandled integer wraparound.
- Paul said he found the bug through manual code analysis and reasoning about the JavaScript interpreter and compiler, rather than fuzzing.
- The proof of concept used Firefox version 137 and demonstrated reading a known value from out-of-bounds memory.
- Mozilla received the exploit details and began the disclosure and fix process. A separate day-one response timeline in the video is explicitly described as a practice drill, not a real incident.
Article Details
- Topics
- [00:00] Day-one Firefox response timeline, later clarified as a practice drill rather than a real incident
- [03:11] Manfred Paul's motivation and manual code-analysis approach
- [06:01] JIT optimization bugs and the limits of fuzzing
- [09:35] Firefox JIT bounds-check elimination and array-access checks
- [13:05] How signed 32-bit integer wraparound caused incorrect bounds analysis
- [15:13] Firefox 137 proof of concept demonstrating out-of-bounds memory access
- Pwn2Own exploit demonstration and disclosure to Mozilla