We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
After selecting a malicious Windows `.url` shortcut from the local filesystem, an unexpected file could be uploaded. *This bug only affects Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox < 137 and Thunderbird < 137.
Reserved 2025-03-31 | Published 2025-04-01 | Updated 2025-04-01 | Assigner mozillaOpening local .url files could lead to another file being opened
Ameen Basha M K
bugzilla.mozilla.org/show_bug.cgi?id=1950056
www.mozilla.org/security/advisories/mfsa2025-20/
www.mozilla.org/security/advisories/mfsa2025-23/
Support options
