Spoofing Risk in Firefox and Thunderbird Due to URL Manipulation
CVE-2025-3029

7.3HIGH

Key Information:

Vendor
Mozilla
Status
Firefox
Firefox Esr
Thunderbird
Vendor
CVE Published:
1 April 2025

Summary

A crafted URL with specific Unicode characters can obscure the true origin of a webpage, enabling potential spoofing attacks. This security issue impacts various versions of Firefox and Thunderbird, making users susceptible to deceptive websites that may impersonate trusted sources. Users are advised to update their applications to the latest versions to mitigate this risk.

Affected Version(s)

Firefox < 137

Firefox ESR < 128.9

Thunderbird < 137

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1952213
https://www.mozilla.org/security/advisories/mfsa2025-20/
https://www.mozilla.org/security/advisories/mfsa2025-22/

CVSS V3.1

Score:
7.3
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Renwa Hiwa
.