CVE-2025-6432
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-06-24

Last updated on: 2026-04-13

Assigner: Mozilla Corporation

Description
When Multi-Account Containers was enabled, DNS requests could have bypassed a SOCKS proxy when the domain name was invalid or the SOCKS proxy was not responding. This vulnerability was fixed in Firefox 140 and Thunderbird 140.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-06-24
Last Modified
2026-04-13
Generated
2026-05-07
AI Q&A
2025-06-24
EPSS Evaluated
2026-05-05
NVD
CVE-2025-6432
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
mozilla firefox From 60.9.0 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability occurs when the Multi-Account Containers feature is enabled in Firefox versions prior to 140. In such cases, DNS requests could bypass a configured SOCKS proxy if the domain name was invalid or if the SOCKS proxy was not responding, potentially exposing DNS traffic that was intended to be routed through the proxy.


How can this vulnerability impact me? :

The vulnerability can lead to DNS requests bypassing the SOCKS proxy, which may expose user browsing activity or DNS queries to unintended parties. This could reduce privacy and security by leaking information that was expected to be protected by the proxy.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart