CVE-2025-8029

HighCVSS 8.1/10Last modified Sep 30, 2026

Description

Thunderbird executed `javascript:` URLs when used in `object` and `embed` tags. This vulnerability was fixed in Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-80

Affected software

Vendor	Product	Versions
Mozilla	Firefox	—
Mozilla	Thunderbird	—

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1928021Permissions Required
https://www.mozilla.org/security/advisories/mfsa2025-56/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2025-58/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2025-59/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2025-61/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2025-62/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2025-63/Vendor Advisory
https://lists.debian.org/debian-lts-announce/2025/07/msg00016.html

Timeline

Published: Jul 22, 2025
Last modified: Sep 30, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-80308.1Insufficient escaping in the “Copy as cURL” feature could potentially be used to trick a user into executing unexpected code. This vulnerabi CVE-2025-80319.8The `username:password` part was not correctly stripped from URLs in CSP reports potentially leaking HTTP Basic Authentication credentials. CVE-2025-80328.1XSLT document loading did not correctly propagate the source document which bypassed its CSP. This vulnerability was fixed in Firefox 141, F CVE-2025-80336.5The JavaScript engine did not handle closed generators correctly and it was possible to resume them leading to a nullptr deref. This vulnera CVE-2025-80348.8Memory safety bugs present in Firefox ESR 115.25, Firefox ESR 128.12, Thunderbird ESR 128.12, Firefox ESR 140.0, Thunderbird ESR 140.0, Fire CVE-2025-80358.8Memory safety bugs present in Firefox ESR 128.12, Thunderbird ESR 128.12, Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderb CVE-2025-80368.1Thunderbird cached CORS preflight responses across IP address changes. This allowed circumventing CORS with DNS rebinding. This vulnerabilit CVE-2025-80379.1Setting a nameless cookie with an equals sign in the value shadowed other cookies. Even if the nameless cookie was set over HTTP and the sha CVE-2025-80389.8Thunderbird ignored paths when checking the validity of navigations in a frame. This vulnerability was fixed in Firefox 141, Firefox ESR 140 CVE-2025-80398.1In some cases search terms persisted in the URL bar even after navigating away from the search page. This vulnerability was fixed in Firefox CVE-2025-80408.8Memory safety bugs present in Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140. Some of these bugs showed evidence CVE-2025-80415.3In the address bar, Firefox for Android truncated the display of URLs from the end instead of prioritizing the origin. This vulnerability wa