CVE-2025-8032 - XSLT documents could bypass CSP

Back Back to CVE browser

HIGH

XSLT documents could bypass CSP

Published Jul 22, 2025

8.1

HIGH

CVSS 3.1

EPSS 0.33%

Description

XSLT document loading did not correctly propagate the source document which bypassed its CSP. This vulnerability was fixed in Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1.

Affected products

Red Hat Enterprise Linux 10

firefox-0:128.13.0-1.el10_0

Fixed · RHSA-2025:11797
Red Hat Enterprise Linux 10

thunderbird-0:128.13.0-3.el10_0

Fixed · RHSA-2025:12188
Red Hat Enterprise Linux 7 Extended Lifecycle Support

firefox-0:128.13.0-1.el7_9

Fixed · RHSA-2025:12278
Red Hat Enterprise Linux 8

firefox-0:128.13.0-1.el8_10

Fixed · RHSA-2025:11747
Red Hat Enterprise Linux 8

thunderbird-0:128.13.0-3.el8_10

Fixed · RHSA-2025:13676
Red Hat Enterprise Linux 8.2 Advanced Update Support

firefox-0:128.13.0-1.el8_2

Fixed · RHSA-2025:12353
Red Hat Enterprise Linux 8.2 Advanced Update Support

thunderbird-0:128.13.0-3.el8_2

Fixed · RHSA-2025:13645
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support

firefox-0:128.13.0-1.el8_4

Fixed · RHSA-2025:12302
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support

thunderbird-0:128.13.0-3.el8_4

Fixed · RHSA-2025:13646
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

firefox-0:128.13.0-1.el8_4

Fixed · RHSA-2025:12302
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

thunderbird-0:128.13.0-3.el8_4

Fixed · RHSA-2025:13646
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support

firefox-0:128.13.0-1.el8_6

Fixed · RHSA-2025:12361
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support

thunderbird-0:128.13.0-3.el8_6

Fixed · RHSA-2025:13651
Red Hat Enterprise Linux 8.6 Telecommunications Update Service

firefox-0:128.13.0-1.el8_6

Fixed · RHSA-2025:12361
Red Hat Enterprise Linux 8.6 Telecommunications Update Service

thunderbird-0:128.13.0-3.el8_6

Fixed · RHSA-2025:13651
Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions

firefox-0:128.13.0-1.el8_6

Fixed · RHSA-2025:12361
Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions

thunderbird-0:128.13.0-3.el8_6

Fixed · RHSA-2025:13651
Red Hat Enterprise Linux 8.8 Telecommunications Update Service

firefox-0:128.13.0-1.el8_8

Fixed · RHSA-2025:12360
Red Hat Enterprise Linux 8.8 Telecommunications Update Service

thunderbird-0:128.13.0-3.el8_8

Fixed · RHSA-2025:13650
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions

firefox-0:128.13.0-1.el8_8

Fixed · RHSA-2025:12360
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions

thunderbird-0:128.13.0-3.el8_8

Fixed · RHSA-2025:13650
Red Hat Enterprise Linux 9

firefox-0:128.13.0-1.el9_6

Fixed · RHSA-2025:11748
Red Hat Enterprise Linux 9

thunderbird-0:128.13.0-3.el9_6

Fixed · RHSA-2025:12187
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

firefox-0:128.13.0-1.el9_0

Fixed · RHSA-2025:12046
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

thunderbird-0:128.13.0-3.el9_0

Fixed · RHSA-2025:13647
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

firefox-0:128.13.0-1.el9_2

Fixed · RHSA-2025:12045
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

thunderbird-0:128.13.0-3.el9_2

Fixed · RHSA-2025:13648
Red Hat Enterprise Linux 9.4 Extended Update Support

firefox-0:128.13.0-1.el9_4

Fixed · RHSA-2025:12044
Red Hat Enterprise Linux 9.4 Extended Update Support

thunderbird-0:128.13.0-3.el9_4

Fixed · RHSA-2025:13649
Red Hat Enterprise Linux 10

rhel10/firefox-flatpak

Affected
Red Hat Enterprise Linux 10

rhel10/thunderbird-flatpak

Affected
Red Hat Enterprise Linux 6

firefox

Out of support scope
Red Hat Enterprise Linux 6

thunderbird

Out of support scope
Red Hat Enterprise Linux 7

thunderbird

Out of support scope

Product	Package	State	Advisory
Red Hat Enterprise Linux 10	firefox-0:128.13.0-1.el10_0	Fixed	RHSA-2025:11797
Red Hat Enterprise Linux 10	thunderbird-0:128.13.0-3.el10_0	Fixed	RHSA-2025:12188
Red Hat Enterprise Linux 7 Extended Lifecycle Support	firefox-0:128.13.0-1.el7_9	Fixed	RHSA-2025:12278
Red Hat Enterprise Linux 8	firefox-0:128.13.0-1.el8_10	Fixed	RHSA-2025:11747
Red Hat Enterprise Linux 8	thunderbird-0:128.13.0-3.el8_10	Fixed	RHSA-2025:13676
Red Hat Enterprise Linux 8.2 Advanced Update Support	firefox-0:128.13.0-1.el8_2	Fixed	RHSA-2025:12353
Red Hat Enterprise Linux 8.2 Advanced Update Support	thunderbird-0:128.13.0-3.el8_2	Fixed	RHSA-2025:13645
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	firefox-0:128.13.0-1.el8_4	Fixed	RHSA-2025:12302
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	thunderbird-0:128.13.0-3.el8_4	Fixed	RHSA-2025:13646
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	firefox-0:128.13.0-1.el8_4	Fixed	RHSA-2025:12302
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	thunderbird-0:128.13.0-3.el8_4	Fixed	RHSA-2025:13646
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	firefox-0:128.13.0-1.el8_6	Fixed	RHSA-2025:12361
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	thunderbird-0:128.13.0-3.el8_6	Fixed	RHSA-2025:13651
Red Hat Enterprise Linux 8.6 Telecommunications Update Service	firefox-0:128.13.0-1.el8_6	Fixed	RHSA-2025:12361
Red Hat Enterprise Linux 8.6 Telecommunications Update Service	thunderbird-0:128.13.0-3.el8_6	Fixed	RHSA-2025:13651
Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	firefox-0:128.13.0-1.el8_6	Fixed	RHSA-2025:12361
Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	thunderbird-0:128.13.0-3.el8_6	Fixed	RHSA-2025:13651
Red Hat Enterprise Linux 8.8 Telecommunications Update Service	firefox-0:128.13.0-1.el8_8	Fixed	RHSA-2025:12360
Red Hat Enterprise Linux 8.8 Telecommunications Update Service	thunderbird-0:128.13.0-3.el8_8	Fixed	RHSA-2025:13650
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	firefox-0:128.13.0-1.el8_8	Fixed	RHSA-2025:12360
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	thunderbird-0:128.13.0-3.el8_8	Fixed	RHSA-2025:13650
Red Hat Enterprise Linux 9	firefox-0:128.13.0-1.el9_6	Fixed	RHSA-2025:11748
Red Hat Enterprise Linux 9	thunderbird-0:128.13.0-3.el9_6	Fixed	RHSA-2025:12187
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	firefox-0:128.13.0-1.el9_0	Fixed	RHSA-2025:12046
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	thunderbird-0:128.13.0-3.el9_0	Fixed	RHSA-2025:13647
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	firefox-0:128.13.0-1.el9_2	Fixed	RHSA-2025:12045
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	thunderbird-0:128.13.0-3.el9_2	Fixed	RHSA-2025:13648
Red Hat Enterprise Linux 9.4 Extended Update Support	firefox-0:128.13.0-1.el9_4	Fixed	RHSA-2025:12044
Red Hat Enterprise Linux 9.4 Extended Update Support	thunderbird-0:128.13.0-3.el9_4	Fixed	RHSA-2025:13649
Red Hat Enterprise Linux 10	rhel10/firefox-flatpak	Affected	n/a
Red Hat Enterprise Linux 10	rhel10/thunderbird-flatpak	Affected	n/a
Red Hat Enterprise Linux 6	firefox	Out of support scope	n/a
Red Hat Enterprise Linux 6	thunderbird	Out of support scope	n/a
Red Hat Enterprise Linux 7	thunderbird	Out of support scope	n/a

Remediation

Red Hat statement

Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Weaknesses (1)

CWE-693

References (15)

https://access.redhat.com/security/cve/CVE-2025-8032
Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1974407
Permissions Required
https://bugzilla.redhat.com/show_bug.cgi?id=2382718
Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-22365
Advisory
https://lists.debian.org/debian-lts-announce/2025/07/msg00016.html
https://nvd.nist.gov/vuln/detail/CVE-2025-8032
https://www.cve.org/CVERecord?id=CVE-2025-8032
https://www.mozilla.org/security/advisories/mfsa2025-56/
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2025-58/
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2025-58/#CVE-2025-8032
https://www.mozilla.org/security/advisories/mfsa2025-59/
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2025-61/
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2025-62/
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2025-62/#CVE-2025-8032
https://www.mozilla.org/security/advisories/mfsa2025-63/
Vendor Advisory

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2025-8032		Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1974407		Permissions Required
https://bugzilla.redhat.com/show_bug.cgi?id=2382718		Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-22365		Advisory
https://lists.debian.org/debian-lts-announce/2025/07/msg00016.html
https://nvd.nist.gov/vuln/detail/CVE-2025-8032
https://www.cve.org/CVERecord?id=CVE-2025-8032
https://www.mozilla.org/security/advisories/mfsa2025-56/		Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2025-58/		Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2025-58/#CVE-2025-8032
https://www.mozilla.org/security/advisories/mfsa2025-59/		Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2025-61/		Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2025-62/		Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2025-62/#CVE-2025-8032
https://www.mozilla.org/security/advisories/mfsa2025-63/		Vendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mozilla

Published Jul 22, 2025

Updated Jul 29, 2026

Reserved Jul 22, 2025

Link CVE-2025-8032

CISA Vulnrichment

Updated Jul 23, 2025

NVD

Status Modified

Modified Oct 5, 2026

Link CVE-2025-8032

Red Hat

Severity Moderate

Public date Jul 22, 2025

Bugzilla 2382718

Link CVE-2025-8032

ENISA EUVD

Assigner mozilla

Published Jul 22, 2025

Updated Jul 29, 2026

Link EUVD-2025-22365

GitHub

No data