Spoofing Vulnerability in Firefox and Thunderbird
CVE-2025-1019
4.3MEDIUM
Summary
A vulnerability allows for the manipulation of the z-order of browser windows, which can conceal fullscreen notifications. This condition may enable attackers to exploit the flaw by conducting spoofing attacks, potentially deceiving users into believing they are interacting with legitimate interfaces. Affected versions include Firefox and Thunderbird prior to version 135.
Affected Version(s)
Firefox < 135
Thunderbird < 135
References
CVSS V3.1
Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Irvan Kurniawan