Misleading Hover Text Vulnerability in Mozilla Thunderbird
CVE-2025-3523

6.4MEDIUM

Key Information:

Vendor

Mozilla
Status
Thunderbird
Vendor
CVE Published:
15 April 2025

What is CVE-2025-3523?

A vulnerability in Mozilla Thunderbird allows for a misleading hover text when users view email attachments containing multiple external links. The issue arises from the X-Mozilla-External-Attachment-URL header, which displays only the last link while correctly redirecting on click. This discrepancy could deceive users, leading them to unknowingly download content from untrusted sources, posing significant risks to personal data security.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Thunderbird < 137.0.2

Thunderbird < 128.9.2

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1958385
https://www.mozilla.org/security/advisories/mfsa2025-26/
https://www.mozilla.org/security/advisories/mfsa2025-27/

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dario WeiĂźer
JSON
.