Process isolation bypass using "javascript:" URI links in cross-origin frames
Published Apr 29, 2025
9.1
CRITICALCVSS 3.1
EPSS 0.45%
Description
A process isolation vulnerability in Thunderbird stemmed from improper handling of javascript: URIs, which could allow content to execute in the top-level document's process instead of the intended frame, potentially enabling a sandbox escape. This vulnerability was fixed in Firefox 138, Firefox ESR 128.10, Firefox ESR 115.23, Thunderbird 138, and Thunderbird 128.10.
Affected products
No data.
- < 115.23
- < 138.0
- ≥ 128.0 · < 128.10
- < 128.10.0
- < 138.0
No data.
Red Hat Enterprise Linux 10
firefox-0:128.10.0-1.el10_0
Fixed · RHSA-2025:7506
Red Hat Enterprise Linux 10
thunderbird-0:128.10.0-1.el10_0
Fixed · RHSA-2025:7507
Red Hat Enterprise Linux 7 Extended Lifecycle Support
firefox-0:128.10.0-1.el7_9
Fixed · RHSA-2025:4751
Red Hat Enterprise Linux 8
firefox-0:128.10.0-1.el8_10
Fixed · RHSA-2025:4458
Red Hat Enterprise Linux 8
thunderbird-0:128.10.0-1.el8_10
Fixed · RHSA-2025:4797
Red Hat Enterprise Linux 8.2 Advanced Update Support
firefox-0:128.10.0-1.el8_2
Fixed · RHSA-2025:7547
Red Hat Enterprise Linux 8.2 Advanced Update Support
thunderbird-0:128.10.0-1.el8_2
Fixed · RHSA-2025:7693
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
firefox-0:128.10.0-1.el8_4
Fixed · RHSA-2025:7545
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
thunderbird-0:128.10.0-1.el8_4
Fixed · RHSA-2025:7691
Red Hat Enterprise Linux 8.4 Telecommunications Update Service
firefox-0:128.10.0-1.el8_4
Fixed · RHSA-2025:7545
Red Hat Enterprise Linux 8.4 Telecommunications Update Service
thunderbird-0:128.10.0-1.el8_4
Fixed · RHSA-2025:7691
Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions
firefox-0:128.10.0-1.el8_4
Fixed · RHSA-2025:7545
Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions
thunderbird-0:128.10.0-1.el8_4
Fixed · RHSA-2025:7691
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
firefox-0:128.10.0-1.el8_6
Fixed · RHSA-2025:7544
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
thunderbird-0:128.10.0-1.el8_6
Fixed · RHSA-2025:7690
Red Hat Enterprise Linux 8.6 Telecommunications Update Service
firefox-0:128.10.0-1.el8_6
Fixed · RHSA-2025:7544
Red Hat Enterprise Linux 8.6 Telecommunications Update Service
thunderbird-0:128.10.0-1.el8_6
Fixed · RHSA-2025:7690
Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
firefox-0:128.10.0-1.el8_6
Fixed · RHSA-2025:7544
Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
thunderbird-0:128.10.0-1.el8_6
Fixed · RHSA-2025:7690
Red Hat Enterprise Linux 8.8 Extended Update Support
firefox-0:128.10.0-1.el8_8
Fixed · RHSA-2025:7543
Red Hat Enterprise Linux 8.8 Extended Update Support
thunderbird-0:128.10.0-1.el8_8
Fixed · RHSA-2025:7689
Red Hat Enterprise Linux 9
firefox-0:128.10.0-1.el9_5
Fixed · RHSA-2025:4443
Red Hat Enterprise Linux 9
firefox-0:128.10.0-1.el9_6
Fixed · RHSA-2025:7428
Red Hat Enterprise Linux 9
thunderbird-0:128.10.0-1.el9_5
Fixed · RHSA-2025:4460
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
firefox-0:128.10.0-1.el9_0
Fixed · RHSA-2025:4753
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
thunderbird-0:128.10.0-1.el9_0
Fixed · RHSA-2025:7692
Red Hat Enterprise Linux 9.2 Extended Update Support
firefox-0:128.10.0-1.el9_2
Fixed · RHSA-2025:4752
Red Hat Enterprise Linux 9.2 Extended Update Support
thunderbird-0:128.10.0-1.el9_2
Fixed · RHSA-2025:7694
Red Hat Enterprise Linux 9.4 Extended Update Support
firefox-0:128.10.0-1.el9_4
Fixed · RHSA-2025:4756
Red Hat Enterprise Linux 9.4 Extended Update Support
thunderbird-0:128.10.0-1.el9_4
Fixed · RHSA-2025:7695
Red Hat Enterprise Linux 10
firefox-flatpak-container
Affected
Red Hat Enterprise Linux 10
thunderbird-flatpak-container
Affected
Red Hat Enterprise Linux 6
firefox
Out of support scope
Red Hat Enterprise Linux 6
thunderbird
Out of support scope
Red Hat Enterprise Linux 7
thunderbird
Out of support scope
Red Hat Enterprise Linux 9
firefox-flatpak-container
Affected
Red Hat Enterprise Linux 9
thunderbird-flatpak-container
Affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 10 | firefox-0:128.10.0-1.el10_0 | Fixed | RHSA-2025:7506 |
| Red Hat Enterprise Linux 10 | thunderbird-0:128.10.0-1.el10_0 | Fixed | RHSA-2025:7507 |
| Red Hat Enterprise Linux 7 Extended Lifecycle Support | firefox-0:128.10.0-1.el7_9 | Fixed | RHSA-2025:4751 |
| Red Hat Enterprise Linux 8 | firefox-0:128.10.0-1.el8_10 | Fixed | RHSA-2025:4458 |
| Red Hat Enterprise Linux 8 | thunderbird-0:128.10.0-1.el8_10 | Fixed | RHSA-2025:4797 |
| Red Hat Enterprise Linux 8.2 Advanced Update Support | firefox-0:128.10.0-1.el8_2 | Fixed | RHSA-2025:7547 |
| Red Hat Enterprise Linux 8.2 Advanced Update Support | thunderbird-0:128.10.0-1.el8_2 | Fixed | RHSA-2025:7693 |
| Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | firefox-0:128.10.0-1.el8_4 | Fixed | RHSA-2025:7545 |
| Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | thunderbird-0:128.10.0-1.el8_4 | Fixed | RHSA-2025:7691 |
| Red Hat Enterprise Linux 8.4 Telecommunications Update Service | firefox-0:128.10.0-1.el8_4 | Fixed | RHSA-2025:7545 |
| Red Hat Enterprise Linux 8.4 Telecommunications Update Service | thunderbird-0:128.10.0-1.el8_4 | Fixed | RHSA-2025:7691 |
| Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions | firefox-0:128.10.0-1.el8_4 | Fixed | RHSA-2025:7545 |
| Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions | thunderbird-0:128.10.0-1.el8_4 | Fixed | RHSA-2025:7691 |
| Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | firefox-0:128.10.0-1.el8_6 | Fixed | RHSA-2025:7544 |
| Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | thunderbird-0:128.10.0-1.el8_6 | Fixed | RHSA-2025:7690 |
| Red Hat Enterprise Linux 8.6 Telecommunications Update Service | firefox-0:128.10.0-1.el8_6 | Fixed | RHSA-2025:7544 |
| Red Hat Enterprise Linux 8.6 Telecommunications Update Service | thunderbird-0:128.10.0-1.el8_6 | Fixed | RHSA-2025:7690 |
| Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions | firefox-0:128.10.0-1.el8_6 | Fixed | RHSA-2025:7544 |
| Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions | thunderbird-0:128.10.0-1.el8_6 | Fixed | RHSA-2025:7690 |
| Red Hat Enterprise Linux 8.8 Extended Update Support | firefox-0:128.10.0-1.el8_8 | Fixed | RHSA-2025:7543 |
| Red Hat Enterprise Linux 8.8 Extended Update Support | thunderbird-0:128.10.0-1.el8_8 | Fixed | RHSA-2025:7689 |
| Red Hat Enterprise Linux 9 | firefox-0:128.10.0-1.el9_5 | Fixed | RHSA-2025:4443 |
| Red Hat Enterprise Linux 9 | firefox-0:128.10.0-1.el9_6 | Fixed | RHSA-2025:7428 |
| Red Hat Enterprise Linux 9 | thunderbird-0:128.10.0-1.el9_5 | Fixed | RHSA-2025:4460 |
| Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions | firefox-0:128.10.0-1.el9_0 | Fixed | RHSA-2025:4753 |
| Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions | thunderbird-0:128.10.0-1.el9_0 | Fixed | RHSA-2025:7692 |
| Red Hat Enterprise Linux 9.2 Extended Update Support | firefox-0:128.10.0-1.el9_2 | Fixed | RHSA-2025:4752 |
| Red Hat Enterprise Linux 9.2 Extended Update Support | thunderbird-0:128.10.0-1.el9_2 | Fixed | RHSA-2025:7694 |
| Red Hat Enterprise Linux 9.4 Extended Update Support | firefox-0:128.10.0-1.el9_4 | Fixed | RHSA-2025:4756 |
| Red Hat Enterprise Linux 9.4 Extended Update Support | thunderbird-0:128.10.0-1.el9_4 | Fixed | RHSA-2025:7695 |
| Red Hat Enterprise Linux 10 | firefox-flatpak-container | Affected | n/a |
| Red Hat Enterprise Linux 10 | thunderbird-flatpak-container | Affected | n/a |
| Red Hat Enterprise Linux 6 | firefox | Out of support scope | n/a |
| Red Hat Enterprise Linux 6 | thunderbird | Out of support scope | n/a |
| Red Hat Enterprise Linux 7 | thunderbird | Out of support scope | n/a |
| Red Hat Enterprise Linux 9 | firefox-flatpak-container | Affected | n/a |
| Red Hat Enterprise Linux 9 | thunderbird-flatpak-container | Affected | n/a |
No package ranges for this CVE.
Remediation
Red Hat statement
Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.
References (12)
- https://access.redhat.com/security/cve/CVE-2025-4083 Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1958350 Permissions Required
- https://bugzilla.redhat.com/show_bug.cgi?id=2362907 Issue Tracking
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-12730 Advisory
- https://lists.debian.org/debian-lts-announce/2025/05/msg00024.html
- https://nvd.nist.gov/vuln/detail/CVE-2025-4083
- https://www.cve.org/CVERecord?id=CVE-2025-4083
- https://www.mozilla.org/security/advisories/mfsa2025-28/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2025-29/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2025-30/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2025-31/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2025-32/ Vendor Advisory
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2025-4083 | Vendor Advisory | |
| https://bugzilla.mozilla.org/show_bug.cgi?id=1958350 | Permissions Required | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2362907 | Issue Tracking | |
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-12730 | Advisory | |
| https://lists.debian.org/debian-lts-announce/2025/05/msg00024.html | ||
| https://nvd.nist.gov/vuln/detail/CVE-2025-4083 | ||
| https://www.cve.org/CVERecord?id=CVE-2025-4083 | ||
| https://www.mozilla.org/security/advisories/mfsa2025-28/ | Vendor Advisory | |
| https://www.mozilla.org/security/advisories/mfsa2025-29/ | Vendor Advisory | |
| https://www.mozilla.org/security/advisories/mfsa2025-30/ | Vendor Advisory | |
| https://www.mozilla.org/security/advisories/mfsa2025-31/ | Vendor Advisory | |
| https://www.mozilla.org/security/advisories/mfsa2025-32/ | Vendor Advisory |
Change history (0)
No recorded changes yet.