Vulnerability in Mozilla Firefox
CVE-2025-6429
Firefox could have incorrectly parsed a URL and rewritten it to the youtube.com domain when parsing the URL specified in an `embed` tag. This could have bypassed website security checks that restricted which domains users were allowed to embed. This vulnerability was fixed in Firefox 140, Firefox ESR 128.12, Thunderbird 140, and Thunderbird 128.12.
EPSS: 0.003 (20.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N.
Affected products
- Mozilla Firefox — versions 128.12, 140
- Mozilla Thunderbird — versions 128.12, 140
Weakness classification (CWE)
References
- security@mozilla.org (Permissions Required)
- security@mozilla.org (Vendor Advisory)
- security@mozilla.org (Vendor Advisory)
- security@mozilla.org
- security@mozilla.org
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
Frequently asked questions
- What is CVE-2025-6429?
- CVE-2025-6429 is a medium-severity vulnerability in Mozilla Firefox, classified under Improper Encoding or Escaping of Output. CVSS score: 6.5/10. Published 2025-06-24.
- How severe is CVE-2025-6429?
- Medium severity. CVSS v3 base score is 6.5 out of 10.