PT-2025-30478 · Mozilla+9 · Thunderbird+11
Mirko Brodesser
·
Published
2025-07-22
·
Updated
2026-02-02
·
CVE-2025-8029
CVSS v2.0
9.4
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
Thunderbird versions prior to 141
Thunderbird versions prior to 128.13
Firefox versions prior to 141
Firefox ESR versions prior to 128.13
Firefox ESR versions prior to 140.1
Description
Thunderbird and Firefox are affected by a flaw where
javascript: URLs are executed when used within object and embed tags.Recommendations
Update Thunderbird to version 141 or later.
Update Firefox to version 141 or later.
Update Firefox ESR to version 128.13 or later.
Update Firefox ESR to version 140.1 or later.
Fix
XSS
Code Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Centos
Debian
Firefox
Firefox Esr
Linuxmint
Red Hat
Rocky Linux
Suse
Thunderbird
Ubuntu