CVE-2025-8038
BaseFortify
Publication date: 2025-07-22
Last updated on: 2026-04-13
Assigner: Mozilla Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mozilla | firefox | From 60.9.0 (exc) |
| mozilla | firefox | From 60.9.0 (exc) |
| mozilla | thunderbird | to 140.0 (inc) |
| mozilla | thunderbird | to 140.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-345 | The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Thunderbird involves the application ignoring paths when checking the validity of navigations within a frame. This means that the software does not properly verify the navigation paths, potentially allowing unintended or malicious navigation actions.
How can this vulnerability impact me? :
Because Thunderbird ignores paths when validating frame navigations, an attacker could exploit this to perform unauthorized navigation actions, potentially leading to security issues such as phishing, information disclosure, or other malicious behaviors within the application.