Unprotected URI Links in Thunderbird Address Book by Mozilla

CVE-2025-1015

Summary

The Thunderbird Address Book contains unsanitized URI fields that could be exploited by attackers. By creating an address book with malicious links, an attacker may trick another user into importing the compromised address book. If the user clicks on the unsanitized link within Thunderbird, it could lead to arbitrary execution of unprivileged JavaScript on a webpage opened within the Thunderbird client. This poses significant security risks as it may allow attackers to manipulate user sessions or steal sensitive information.

References