by Kastro
Paper/Archive/CVE-2025-4083

CVE-2025-4083

Mozilla Firefox — Process isolation bypass using "javascript:" URI links in cross-origin frames

EPSS 0.5%CVSS 9.1
critical.is priorityof 100
35
CVSS 9.1 (ADP)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 39.8.398 × 208.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A process isolation vulnerability in Thunderbird stemmed from improper handling of javascript: URIs, which could allow content to execute in the top-level document's process instead of the intended frame, potentially enabling a sandbox escape. This vulnerability was fixed in Firefox 138, Firefox ESR 128.10, Firefox ESR 115.23, Thunderbird 138, and Thunderbird 128.10.

Affected

ProductAffectedFixed inSource
Firefoxsee advisory115.23CNA
Thunderbirdsee advisory128.10CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refbugzilla.mozilla.org/show_bug.cgi?id=1958350refmozilla.org/security/advisories/mfsa2025-28refmozilla.org/security/advisories/mfsa2025-29refmozilla.org/security/advisories/mfsa2025-30refmozilla.org/security/advisories/mfsa2025-31refmozilla.org/security/advisories/mfsa2025-32reflists.debian.org/debian-lts-announce/2025/05/msg00024.html