CVE-2025-1013

MediumCVSS 6.5/10Last modified Oct 5, 2026

Description

A race condition could have led to private browsing tabs being opened in normal browsing windows. This could have resulted in a potential privacy leak. This vulnerability was fixed in Firefox 135, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-362

Affected software

VendorProductVersions
MozillaFirefox—
MozillaThunderbird—

References

Timeline

Published
Feb 4, 2025
Last modified
Oct 5, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-101306.4The Layers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'webcam' shortcode in all versions up to, and CVE-2025-101316.4The All Social Share Options plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sc' shortcode in all versioCVE-2025-101326.4The Dhivehi Text plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dhivehi' shortcode in all versions up tCVE-2025-101336.4The URLYar URL Shortner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'urlyar_shortlink' shortcode in aCVE-2025-101349.1The Goza - Nonprofit Charity WordPress Theme theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path valiCVE-2025-101356.4The WP ViewSTL plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'viewstl' shortcode in all versions up to,CVE-2025-101366.4The TweetThis Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tweetthis' shortcode in all versCVE-2025-101375.4The Snow Monkey theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 29.1.5 via the requesCVE-2025-101386.4The This-or-That plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'thisorthat' shortcode in all versions uCVE-2025-101396.4The WP BookWidgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bw_link' shortcode in all versions upCVE-2025-10148.8Certificate length was not properly checked when added to a certificate store. In practice only trusted data was processed. This vulnerabiliCVE-2025-101406.4The Quick Social Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'quick-login' shortcode in all ver
CVE-2025-1013: Medium severity, CVSS 6.5 | Vulnix