Clickjacking Vulnerability in Firefox Browser
CVE-2025-6434

4.3MEDIUM

Key Information:

Vendor

Mozilla
Status
Firefox
Thunderbird
Vendor
CVE Published:
24 June 2025

What is CVE-2025-6434?

A vulnerability in the Firefox browser allows an attacker to exploit the HTTPS-Only feature's exception page by omitting an anti-clickjacking delay. This flaw could enable malicious users to deceive individuals into permitting an exception, thereby forcing the browser to load a website over an insecure HTTP connection. This issue is present in all Firefox versions prior to 140, potentially compromising user privacy and security.

Affected Version(s)

Firefox < 140

Thunderbird < 140

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1955182
https://www.mozilla.org/security/advisories/mfsa2025-51/
https://www.mozilla.org/security/advisories/mfsa2025-54/

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hafiizh & kang ali
.