CVE-2025-6425CWE-200information-disclosure

CVE-2025-6425

Medium · published June 24, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
22.6
In the wild
Unconfirmed
What it is

An attacker who enumerated resources from the WebCompat extension could have obtained a persistent UUID that identified the browser, and persisted between containers and normal/private browsing mode, but not profiles. This vulnerability was fixed in Firefox 140, Firefox ESR 115.25, Firefox ESR 128.12, Thunderbird 140, and Thunderbird 128.12.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00310 · 22.6th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2025-06-24T17:15Z
Affected products (3)
ProductVersionsFixed in
mozilla/firefox< 115.25.0115.25.0
mozilla/firefox< 140.0140.0
mozilla/firefox≥ 116.0, < 128.12.0128.12.0
References (8)
https://bugzilla.mozilla.org/show_bug.cgi?id=1717672 · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-51/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-52/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-53/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-54/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-55/ · [email protected]https://lists.debian.org/debian-lts-announce/2025/06/msg00029.html · af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2025/07/msg00002.html · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 24 JUN 12:27Z
    The WebCompat WebExtension shipped with Firefox exposed a persistent UUID
    cvelistv5