CORS Bypass Vulnerability in Mozilla Thunderbird and Firefox Products

CVE-2025-8036

What is CVE-2025-8036?

A significant security flaw in Mozilla products, namely Firefox and Thunderbird, allows attackers to circumvent Cross-Origin Resource Sharing (CORS) protections through DNS rebinding. This vulnerability arises from the improper caching of CORS preflight responses when there are changes in IP addresses. As a result, untrusted origins can gain access to sensitive information, posing a serious risk to users of impacted versions.

References