CVE-2025-6429

Description

Firefox could have incorrectly parsed a URL and rewritten it to the youtube.com domain when parsing the URL specified in an `embed` tag. This could have bypassed website security checks that restricted which domains users were allowed to embed. This vulnerability affects Firefox < 140 and Firefox ESR < 128.12.

Reserved 2025-06-20 | Published 2025-06-24 | Updated 2025-06-24 | Assigner mozilla

Problem types

Incorrect parsing of URLs could have allowed embedding of youtube.com

Product status

Any version before 140
affected

Any version before 128.12
affected

Credits

Masato Kinugawa

References

bugzilla.mozilla.org/show_bug.cgi?id=1970658

www.mozilla.org/security/advisories/mfsa2025-51/

www.mozilla.org/security/advisories/mfsa2025-53/

cve.org (CVE-2025-6429)

nvd.nist.gov (CVE-2025-6429)

Download JSON