High · published December 9, 2025
⚡ A crafty spoofing issue lurks in the Downloads Panel of Firefox and Thunderbird, making it easy for attackers to mislead users — think of a misleading delivery notice that reroutes your packages! 📦 This vulnerability acts like a courier who mislabels packages, sending them to the wrong address without anyone noticing. Just like you might receive a surprise instead of your actual order, a user could be fooled into thinking they’re downloading safe content when it’s not. An attacker could exploit this vulnerability to present misleading information about downloads, potentially tricking users into downloading harmful files. This could lead to unauthorized access or data breaches, causing serious damage if a user falls for the ruse.
This vulnerability acts like a courier who mislabels packages, sending them to the wrong address without anyone noticing. Just like you might receive a surprise instead of your actual order, a user could be fooled into thinking they’re downloading safe content when it’s not. This spoofing vulnerability occurs in the Downloads Panel component, allowing attackers to misrepresent download sources, creating a false sense of security for the user.
An attacker could exploit this vulnerability to present misleading information about downloads, potentially tricking users into downloading harmful files. This could lead to unauthorized access or data breaches, causing serious damage if a user falls for the ruse. Update to Firefox 146, Thunderbird 146, Firefox ESR 140.7, or Thunderbird 140.7 immediately to patch this vulnerability. Additionally, remind users to verify the authenticity of downloads, ensuring they are from trusted sources. You've got this! Keep your software updated and stay vigilant to outsmart those sneaky attackers! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| mozilla/firefox | < 146.0 | 146.0 |
| mozilla/thunderbird | < 146.0 | 146.0 |