CVE-2025-3035
published 2025-04-01CVE-2025-3035: By first using the AI chatbot in one tab and later activating it in another tab, the document title of the previous tab would leak into the chat prompt. This…
PriorityP424medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.28%
19.6th percentile
By first using the AI chatbot in one tab and later activating it in another tab, the document title of the previous tab would leak into the chat prompt. This vulnerability was fixed in Firefox 137.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | firefox | < firefox 137.0-1 (sid) | firefox 137.0-1 (sid) |
| mozilla | firefox | < 137.0 | 137.0 |
| mozilla | firefox | — | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
osv5.3MEDIUM
vendor_redhat5.5MEDIUM
vendor_debian5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2025-3035: By first using the AI chatbot in one tab and later activating it in another tab, the document title of the previous tab would leak into the chat promp
osv·2025-04-01·CVSS 5.3
CVE-2025-3035 [MEDIUM] CVE-2025-3035: By first using the AI chatbot in one tab and later activating it in another tab, the document title of the previous tab would leak into the chat promp
By first using the AI chatbot in one tab and later activating it in another tab, the document title of the previous tab would leak into the chat prompt. This vulnerability affects Firefox < 137.
GHSA
GHSA-p549-c3cg-f4qm: By first using the AI chatbot in one tab and later activating it in another tab, the document title of the previous tab would leak into the chat promp
ghsa_unreviewed·2025-04-01
CVE-2025-3035 [MEDIUM] CWE-359 GHSA-p549-c3cg-f4qm: By first using the AI chatbot in one tab and later activating it in another tab, the document title of the previous tab would leak into the chat promp
By first using the AI chatbot in one tab and later activating it in another tab, the document title of the previous tab would leak into the chat prompt. This vulnerability affects Firefox < 137.
Red Hat
kernel: wifi: mt76: disable napi on driver removal
vendor_redhat·2025-06-18·CVSS 5.5
CVE-2025-38009 [MEDIUM] CWE-20 kernel: wifi: mt76: disable napi on driver removal
kernel: wifi: mt76: disable napi on driver removal
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: disable napi on driver removal
A warning on driver removal started occurring after commit 9dd05df8403b
("net: warn if NAPI instance wasn't shut down"). Disable tx napi before
deleting it in mt76_dma_cleanup().
WARNING: CPU: 4 PID: 18828 at net/core/dev.c:7288 __netif_napi_del_locked+0xf0/0x100
CPU: 4 UID: 0 PID: 18828 Comm: modprobe Not tainted 6.15.0-rc4 #4 PREEMPT(lazy)
Hardware name: ASUS System Product Name/PRIME X670E-PRO WIFI, BIOS 3035 09/05/2024
RIP: 0010:__netif_napi_del_locked+0xf0/0x100
Call Trace:
mt76_dma_cleanup+0x54/0x2f0 [mt76]
mt7921_pci_remove+0xd5/0x190 [mt7921e]
pci_device_remove+0x47/0xc0
device_release_driver_internal+0x19e/0x200
driver_
Debian
CVE-2025-3035: firefox - By first using the AI chatbot in one tab and later activating it in another tab,...
vendor_debian·2025·CVSS 5.3
CVE-2025-3035 [MEDIUM] CVE-2025-3035: firefox - By first using the AI chatbot in one tab and later activating it in another tab,...
By first using the AI chatbot in one tab and later activating it in another tab, the document title of the previous tab would leak into the chat prompt. This vulnerability affects Firefox < 137.
Scope: local
sid: resolved (fixed in 137.0-1)
Mozilla
Mozilla Foundation Security Advisory 2025-20: CVE-2025-3035
vendor_mozilla·CVSS 5.3
CVE-2025-3035 [MEDIUM] Mozilla Foundation Security Advisory 2025-20: CVE-2025-3035
Mozilla Foundation Security Advisory 2025-20
CVE: CVE-2025-3035
Product: Firefox
Impact: high
Fixed in: Firefox 137
No detection rules found.
No public exploits indexed.
2025-04-01
Published