PT-2025-26724 · Mozilla+5 · Firefox+5

Alan Li · Published 2025-06-24 · Updated 2026-02-02 · CVE-2025-6427

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 140

Description: An attacker was able to bypass the connect-src directive of a Content Security Policy by manipulating subdocuments, which would have also hidden the connections from the Network tab in Devtools.

Recommendations: For versions prior to 140, update to version 140 or later to resolve the issue. As a temporary workaround, consider restricting the use of subdocuments to minimize the risk of exploitation.

Fix

Protection Mechanism Failure

Weakness Enumeration

CWE-693

Related Identifiers

ALT-PU-2025-11100

ALT-PU-2025-11495

ALT-PU-2025-11497

ALT-PU-2025-14599

ALT-PU-2025-8725

ALT-PU-2025-9988

BDU:2025-07652

CVE-2025-6427

OPENSUSE-SU-2025:15325-1

OPENSUSE-SU-2025:15371-1

OPENSUSE-SU-2025:15383-1

SUSE-SU-2025:02339-1

SUSE-SU-2025:02529-1

SUSE-SU-2025:02546-1

SUSE-SU-2025_02339-1

SUSE-SU-2025_02529-1

USN-7991-1

Affected Products

Alt Linux

Astra Linux

Firefox

Linuxmint

Suse

Ubuntu

References · 176

• https://ubuntu.com/security/CVE-2025-13015 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-0887 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-11711 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2025-51 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-0891 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2025-54 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2025-51 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-14328 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:02339-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15383-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-8039 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:02529-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-11715 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-8038 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-6434 · Vendor Advisory