CVE-2025-8038

Description

Thunderbird ignored paths when checking the validity of navigations in a frame. This vulnerability affects Firefox < 141, Firefox ESR < 140.1, Thunderbird < 141, and Thunderbird < 140.1.

Reserved 2025-07-22 | Published 2025-07-22 | Updated 2025-07-22 | Assigner mozilla

Problem types

CSP frame-src was not correctly enforced for paths

Product status

Any version before 141
affected

Any version before 140.1
affected

Any version before 141
affected

Any version before 140.1
affected

Credits

Laurin Weger

References

bugzilla.mozilla.org/show_bug.cgi?id=1808979

www.mozilla.org/security/advisories/mfsa2025-56/

www.mozilla.org/security/advisories/mfsa2025-59/

www.mozilla.org/security/advisories/mfsa2025-61/

www.mozilla.org/security/advisories/mfsa2025-63/

cve.org (CVE-2025-8038)

nvd.nist.gov (CVE-2025-8038)

Download JSON