Content Security Policy Bypass in Firefox by Mozilla

CVE-2025-6427

What is CVE-2025-6427?

A vulnerability was discovered in Firefox that allows attackers to bypass the connect-src directive of a Content Security Policy through subdocument manipulation. This exploit could obscure the connections made by the attacker in the Network tab of Developer Tools, effectively hiding malicious activities from users and developers. This issue primarily impacts Firefox versions earlier than 140, posing a risk to web applications that rely on CSP for securing their content and resources.

References