CVE-2025-4088

MEDIUM

Firefox and Thunderbird < 138.0 - Cross-Site Request Forgery via Storage Access API Redirect

Title source: llm

Description

A security vulnerability in Thunderbird allowed malicious sites to use redirects to send credentialed requests to arbitrary endpoints on any site that had invoked the Storage Access API. This enabled potential Cross-Site Request Forgery attacks across origins. This vulnerability was fixed in Firefox 138 and Thunderbird 138.

References (3)

Core 3

Core References

Permissions Required

https://bugzilla.mozilla.org/show_bug.cgi?id=1953521

Vendor Advisory

https://www.mozilla.org/security/advisories/mfsa2025-28/

Vendor Advisory

https://www.mozilla.org/security/advisories/mfsa2025-31/

Scores

CVSS v3 6.5

EPSS 0.0012

EPSS Percentile 29.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-352

Status published

Products (4)

mozilla/firefox < 138.0

Mozilla/Firefox 138

mozilla/thunderbird < 138.0

Mozilla/Thunderbird 138

Published Apr 29, 2025

Tracked Since Feb 18, 2026