Security readout for executives and security teams
Plain-English summary
Malicious content could bypass Firefox or Thunderbird process separation, running in a more privileged document process and potentially escaping the sandbox. Successful exploitation could expose or alter sensitive information. Mozilla identifies fixed releases, making prompt version verification and updating the primary response.
Executive priority
Treat this as an immediate patching priority because of its 9.1 score, potential sandbox escape, and high confidentiality and integrity impact. There is no supplied evidence of active exploitation, but delayed remediation leaves commonly used endpoint software exposed to a serious isolation failure.
Technical view
Improper handling of javascript: URIs in cross-origin frames could execute content in the top-level document’s process rather than the intended frame process. This may enable sandbox escape. CVSS 3.1 is 9.1: network-accessible, low complexity, no privileges or interaction, with high confidentiality and integrity impact but no stated availability impact. It maps to CWE-653.
Likely exposure
Potential exposure includes Firefox and Thunderbird installations not at the applicable fixed releases. The named fixes are Firefox 138, ESR 128.10, ESR 115.23, Thunderbird 138, and Thunderbird 128.10. The bundle’s affected table ambiguously repeats these fixed versions, so confirm precise branch applicability through Mozilla’s advisories.
Exploitation context
The bundle marks this CVE as absent from KEV, and no supplied source states that it is actively exploited. The network and no-interaction CVSS metrics indicate low-friction theoretical reachability, but they do not demonstrate public exploit availability or attacks in the wild.
Researcher notes
The core security-boundary failure is execution in the top-level document process rather than the cross-origin frame’s intended process. Public evidence supports potential sandbox escape, not a confirmed complete escape chain. The source bundle inconsistently labels fixed releases as affected; avoid deriving exact vulnerable ranges without checking each Mozilla advisory.
Mitigation direction
- Upgrade Firefox to the applicable fixed release: 138, ESR 128.10, or ESR 115.23.
- Upgrade Thunderbird to the applicable fixed release: 138 or 128.10.
- Review Mozilla advisories for branch-specific guidance and unsupported-version handling.
Validation and detection
- Inventory Firefox and Thunderbird versions across managed and unmanaged endpoints.
- Confirm Firefox installations meet an applicable named fixed release.
- Confirm Thunderbird installations meet an applicable named fixed release.
- Verify update deployment through endpoint-management telemetry and rescan for outdated installations.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-653: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2025-4083 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N3.95.2CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
9.1CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://bugzilla.mozilla.org/show_bug.cgi?id=1958350CVE reference, mozilla
- https://www.mozilla.org/security/advisories/mfsa2025-28/CVE reference, mozilla
- https://www.mozilla.org/security/advisories/mfsa2025-29/CVE reference, mozilla
- https://www.mozilla.org/security/advisories/mfsa2025-30/CVE reference, mozilla
- https://www.mozilla.org/security/advisories/mfsa2025-31/CVE reference, mozilla
- https://www.mozilla.org/security/advisories/mfsa2025-32/CVE reference, mozilla
- https://lists.debian.org/debian-lts-announce/2025/05/msg00024.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Isolation or Compartmentalization
Improper Isolation or Compartmentalization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.