CVEvulnerability

CVE-2025-6427

9.1 CRITICAL Published 2025-06-24 Modified 2026-09-30 Official page ↗
Status
Modified
Published
2025-06-24
Last modified
2026-09-30
Assigner
[email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-693

Description

An attacker was able to bypass the `connect-src` directive of a Content Security Policy by manipulating subdocuments. This would have also hidden the connections from the Network tab in Devtools. This vulnerability was fixed in Firefox 140 and Thunderbird 140.

Affected configurations

• mozilla firefox (< 140.0)

Related

Weakness · CWE (1)

  • CWE-693 Protection Mechanism Failure weakness

References