CVE-2025-3029

HIGH

Mozilla Firefox < 128.9.0 - Authentication Bypass by Spoofing

Title source: rule

Description

A crafted URL containing specific Unicode characters could have hidden the true origin of the page, resulting in a potential spoofing attack. This vulnerability was fixed in Firefox 137, Firefox ESR 128.9, Thunderbird 137, and Thunderbird 128.9.

References (6)

[Mailing List] https://lists.debian.org/debian-lts-announce/2025/04/msg00005.html

[Issue Tracking, Permissions Required] https://bugzilla.mozilla.org/show_bug.cgi?id=1952213

[Vendor Advisory] https://www.mozilla.org/security/advisories/mfsa2025-20/

[Vendor Advisory] https://www.mozilla.org/security/advisories/mfsa2025-22/

[Vendor Advisory] https://www.mozilla.org/security/advisories/mfsa2025-23/

[Vendor Advisory] https://www.mozilla.org/security/advisories/mfsa2025-24/

Scores

CVSS v3 7.3

EPSS 0.0065

EPSS Percentile 71.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-290

Status published

Products (7)

mozilla/firefox < 128.9.0

mozilla/firefox < 137.0

Mozilla/Firefox 128.9 - 128.*

Mozilla/Firefox 137

mozilla/thunderbird < 128.9.0

Mozilla/Thunderbird 128.9 - 128.*

Mozilla/Thunderbird 137

Published Apr 01, 2025

Tracked Since Feb 18, 2026