CVE-2025-6427

Katalog CVE

CVSS 9.1 · Critical EPSS 0,37%

Kerentanan Protection Mechanism Failure pada mozilla firefox. Skor CVSS 3.1 9.1 (Critical) menurut CISA ADP.

Deskripsi (NVD)

An attacker was able to bypass the `connect-src` directive of a Content Security Policy by manipulating subdocuments. This would have also hidden the connections from the Network tab in Devtools. This vulnerability was fixed in Firefox 140 and Thunderbird 140.

Rincian

Terbit di NVD

24 Juni 2025

Terakhir diubah

30 September 2026

Status NVD

Modified

CVSS 3.1

9.1 (Critical), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-693: Protection Mechanism Failure

EPSS (30 hari)

0,37% peluang dieksploitasi; lebih tinggi dari 28,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.mozilla.org/security/advisories/mfsa2025-51/ advisory vendor
• https://bugzilla.mozilla.org/show_bug.cgi?id=1966927 permissions required
• https://www.mozilla.org/security/advisories/mfsa2025-54/