File Extension Disclosure in Firefox for Android and Thunderbird by Mozilla

CVE-2025-4086

What is CVE-2025-4086?

A flaw exists in Firefox for Android and Thunderbird where a specially crafted filename, containing multiple encoded newline characters, can mask the true file extension in download dialogs. This issue may lead to user confusion or exploitation, compromising the integrity and security of user data when files are downloaded. The risk is present on specific versions of Firefox and Thunderbird, requiring immediate attention for affected users.

References