CVE-2025-10536
BaseFortify
Publication date: 2025-09-16
Last updated on: 2026-04-13
Assigner: Mozilla Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mozilla | thunderbird | to 140.0 (inc) |
| mozilla | thunderbird | to 140.0 (inc) |
| mozilla | firefox | From 60.9.0 (exc) |
| mozilla | firefox | From 60.9.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a same-origin policy bypass affecting Firefox versions below 143 and Thunderbird versions below 140.3. The same-origin policy is a critical security mechanism that restricts how documents or scripts loaded from one origin can interact with resources from another origin. By bypassing this policy, an attacker could potentially gain unauthorized access to web content or sensitive information from different origins, undermining the browser's security model. [1, 2, 3]
How can this vulnerability impact me? :
Exploiting this vulnerability could allow an attacker to circumvent the same-origin policy, leading to unauthorized access to sensitive information or actions across different web origins. This can result in significant security and privacy risks, including data theft or manipulation. In Thunderbird, the risk is somewhat mitigated because scripting is disabled when reading mail, but the vulnerability still poses potential risks in browser or browser-like contexts. [1, 2, 3]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately update Firefox to version 143 or later, and Thunderbird to version 140.3 or later. These versions include fixes that address the vulnerability by reinforcing the same-origin policy and preventing bypasses in the Layout component. [1, 2, 3]