CVE-2025-6427
BaseFortify
Publication date: 2025-06-24
Last updated on: 2026-04-13
Assigner: Mozilla Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mozilla | firefox | From 60.9.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-693 | The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability allows an attacker to bypass the 'connect-src' directive of a Content Security Policy by manipulating subdocuments. This means the attacker can make unauthorized connections that should have been blocked by the policy, and these connections would also be hidden from the Network tab in the browser's Developer Tools.
How can this vulnerability impact me? :
The vulnerability can allow attackers to make unauthorized network connections from a web page, potentially leading to data exfiltration or communication with malicious servers without detection, as these connections are hidden from the browser's Network tab.