CVE-2025-6427

CriticalCVSS 9.1/10Last modified Sep 30, 2026

Description

An attacker was able to bypass the `connect-src` directive of a Content Security Policy by manipulating subdocuments. This would have also hidden the connections from the Network tab in Devtools. This vulnerability was fixed in Firefox 140 and Thunderbird 140.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-693

Affected software

Vendor	Product	Versions
Mozilla	Firefox	—
Mozilla	Thunderbird	—

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1966927Permissions Required
https://www.mozilla.org/security/advisories/mfsa2025-51/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2025-54/

Timeline

Published: Jun 24, 2025
Last modified: Sep 30, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-642706.5Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in masteriyo Masteriyo - LMS learning-management-sy CVE-2025-642716.5Cross-Site Request Forgery (CSRF) vulnerability in HasThemes WP Plugin Manager wp-plugin-manager allows Cross Site Request Forgery.This issu CVE-2025-642726.5Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in GetResponse Email marketing for WordPress by Get CVE-2025-642736.5Missing Authorization vulnerability in GetResponse Email marketing for WordPress by GetResponse Official getresponse-official allows Exploit CVE-2025-642744.3Missing Authorization vulnerability in wpkoithemes WPKoi Templates for Elementor wpkoi-templates-for-elementor allows Exploiting Incorrectly CVE-2025-642756.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevelop Booking Manager booking-mana CVE-2025-642766.5Missing Authorization vulnerability in Ays Pro Survey Maker survey-maker allows Exploiting Incorrectly Configured Access Control Security Le CVE-2025-642775.3Missing Authorization vulnerability in QuantumCloud ChatBot chatbot allows Exploiting Incorrectly Configured Access Control Security Levels.CVE-2025-64284.3When a URL was provided in a link querystring parameter, Firefox for Android would follow that URL instead of the correct URL, potentially l CVE-2025-642809.8A SQL Injection Vulnerability in CentralSquare Community Development 19.5.7 allows attackers to inject SQL via the permit_no field.CVE-2025-642819.8An Authentication Bypass issue in CentralSquare Community Development 19.5.7 allows attackers to access the admin panel without admin creden CVE-2025-642824.3Authorization Bypass Through User-Controlled Key vulnerability in RadiusTheme Radius Blocks radius-blocks allows Exploiting Incorrectly Conf