CVE-2025-6425 — Sensitive Information Exposure in Mozilla Firefox

CWE-200 — Sensitive Information Exposure12 documents8 sources
Severity
4.3MEDIUMNVD
EPSS
0.1%
top 70.13%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Mozilla ThunderbirdMozilla Firefox
Timeline
PublishedJun 24
Latest updateJul 22

Description

An attacker who enumerated resources from the WebCompat extension could have obtained a persistent UUID that identified the browser, and persisted between containers and normal/private browsing mode, but not profiles. This vulnerability was fixed in Firefox 140, Firefox ESR 115.25, Firefox ESR 128.12, Thunderbird 140, and Thunderbird 128.12.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages2 packages

▶NVDmozilla/firefox116.0 — 128.12.0+2
▶Debianmozilla/thunderbird< 1:128.12.0esr-1~deb11u1+3

🔴Vulnerability Details

3
GHSA
GHSA-2h3c-qrcw-962q: An attacker who enumerated resources from the WebCompat extension could have obtained a persistent UUID that identified the browser, and persisted bet↗2025-06-26
▶
CVEList
The WebCompat WebExtension shipped with Firefox exposed a persistent UUID↗2025-06-24
▶
OSV
CVE-2025-6425: An attacker who enumerated resources from the WebCompat extension could have obtained a persistent UUID that identified the browser, and persisted bet↗2025-06-24
▶

📋Vendor Advisories

8
Ubuntu
Thunderbird vulnerabilities↗2025-07-22
▶
Red Hat
firefox: thunderbird: The WebCompat WebExtension shipped with Firefox exposed a persistent UUID↗2025-06-24
▶
Debian
CVE-2025-6425: firefox - An attacker who enumerated resources from the WebCompat extension could have obt...↗2025
▶
Mozilla
Mozilla Foundation Security Advisory 2025-51: CVE-2025-6425↗
▶
Mozilla
Mozilla Foundation Security Advisory 2025-52: CVE-2025-6425↗
▶
CVE-2025-6425 — Sensitive Information Exposure | cvebase