CVE-2025-8038CWE-345

CVE-2025-8038

Critical · published July 23, 2025

CVSS v3.1
9.8
EPSS
0%
Percentile
16.5
In the wild
Unconfirmed
What it is

🚨 A sneaky oversight in Thunderbird lets attackers navigate frames without proper checks! 🔥 Think of it as a hotel receptionist who lets anyone into the VIP lounge just because they showed a random keycard — no verification needed! This could allow an attacker to craft a malicious link that manipulates what users see in their browser, potentially leading to data theft or phishing attacks. Essentially, it’s like rolling out the red carpet for cybercriminals, inviting them right into your sensitive data!

Put simply

Think of it as a hotel receptionist who lets anyone into the VIP lounge just because they showed a random keycard — no verification needed! CVE-2025-8038 arises because Thunderbird fails to validate navigation paths within frames, allowing unauthorized content to be displayed. This flaw can be exploited to mislead users, as the browser may render untrusted content without warning.

What to do

This could allow an attacker to craft a malicious link that manipulates what users see in their browser, potentially leading to data theft or phishing attacks. Essentially, it’s like rolling out the red carpet for cybercriminals, inviting them right into your sensitive data! Immediate action is critical: update Thunderbird to version 141 or 140.1 to secure your application. If you're using Firefox, ensure you're running versions 141 or ESR 140.1. Regularly review your applications for such vulnerabilities to stay one step ahead! You've got this! With these updates, you're on your way to being a security hero! 🦸

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00258 · 16.5th percentile
Weakness
CWE-345 · Insufficient Verification of Data Authenticity
Published
2025-07-23T01:15Z
Affected products (4)
ProductVersionsFixed in
mozilla/firefox< 140.1.0140.1.0
mozilla/firefox< 141.0141.0
mozilla/thunderbird< 140.1.0140.1.0
mozilla/thunderbird< 141.0141.0
References (5)
EPSS history
Timeline
  • 22 JUL 20:49Z
    CSP frame-src was not correctly enforced for paths
    cvelistv5