CVE-2025-11712 — Improper Encoding or Escaping of Output in Mozilla Firefox
CWE-116 — Improper Encoding or Escaping of OutputCWE-436 — Interpretation Conflict11 documents8 sources
Severity
6.1MEDIUMNVD
EPSS
0.0%
top 88.07%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedOct 14
Latest updateFeb 2
Description
A malicious page could have used the type attribute of an OBJECT tag to override the default browser behavior when encountering a web resource served without a content-type. This could have contributed to an XSS on a site that unsafely serves files without a content-type header. This vulnerability was fixed in Firefox 144, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7
Affected Packages3 packages
🔴Vulnerability Details
3CVEList▶
An OBJECT tag type attribute overrode browser behavior on web resources without a content-type↗2025-10-14
GHSA▶
GHSA-rf6g-cf9f-g4v7: A malicious page could have used the type attribute of an OBJECT tag to override the default browser behavior when encountering a web resource served↗2025-10-14
OSV▶
CVE-2025-11712: A malicious page could have used the type attribute of an OBJECT tag to override the default browser behavior when encountering a web resource served↗2025-10-14