Critical · published June 24, 2025
🚨 A crafty trick lets attackers slip past the `connect-src` directive of your Content Security Policy without a trace! 🔥 Think of it like a sneaky magician who distracts the audience while they pull a rabbit out of a hat — the connections disappear from the Network tab in Devtools, leaving you none the wiser. This vulnerability opens the door for attackers to connect to malicious servers, potentially allowing them to exfiltrate sensitive data or inject harmful scripts. If your applications are tricked into making these connections, the fallout could be absolutely devastating!
Think of it like a sneaky magician who distracts the audience while they pull a rabbit out of a hat — the connections disappear from the Network tab in Devtools, leaving you none the wiser. By manipulating subdocuments, an attacker can bypass the `connect-src` directive in your Content Security Policy, effectively hiding their connections from your monitoring tools.
This vulnerability opens the door for attackers to connect to malicious servers, potentially allowing them to exfiltrate sensitive data or inject harmful scripts. If your applications are tricked into making these connections, the fallout could be absolutely devastating! Update to Firefox 140 or Thunderbird 140 immediately to address this vulnerability. Ensure your Content Security Policy is robust and consider reviewing it regularly to catch any sneaky behavior in the future. You've got this! Fixing this is a straightforward step towards fortifying your security fortress! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| mozilla/firefox | < 140.0 | 140.0 |