CVE-2023-25729

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Permission prompts for opening external schemes were only shown for <code>ContentPrincipals</code> resulting in extensions being able to open them without user interaction via <code>ExpandedPrincipals</code>. This could lead to further malicious actions such as downloading files or interacting with software already installed on the system. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Jun 2, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-25738.8Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by an command injection vulnerability in the NTP server input field CVE-2023-257305.4A background script invoking <code>requestFullscreen</code> and then blocking the main thread could force the browser into fullscreen mode i CVE-2023-257318.8Due to URL previews in the network panel of developer tools improperly storing URLs, query parameters could potentially be used to overwrite CVE-2023-257328.8When encoding data from an <code>inputStream</code> in <code>xpcom</code> the size of the input being encoded was not correctly calculated p CVE-2023-257337.5The return value from `gfx::SourceSurfaceSkia::Map()` wasn't being verified which could have potentially lead to a null pointer dereference.CVE-2023-257348.1After downloading a Windows <code>.url</code> shortcut from the local filesystem, an attacker could supply a remote path that would lead to CVE-2023-257358.8Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment CVE-2023-257369.8An invalid downcast from `nsHTMLDocument` to `nsIContent` could have lead to undefined behavior. This vulnerability affects Firefox < 110.CVE-2023-257378.8An invalid downcast from <code>nsTextNode</code> to <code>SVGElement</code> could have lead to undefined behavior. This vulnerability affect CVE-2023-257386.5Members of the <code>DEVMODEW</code> struct set by the printer device driver weren't being validated and could have resulted in invalid valu CVE-2023-257398.8Module load requests that failed were not being checked as to whether or not they were cancelled causing a use-after-free in <code>ScriptLoa CVE-2023-25748.8Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by an command injection vulnerability in the device name input fiel