CVE-2025-9183 — Spoofing issue in the Address Bar component

MEDIUM

Spoofing issue in the Address Bar component

Published Aug 19, 2025

6.5

MEDIUM

CVSS 3.1

EPSS 0.26%

Spoofing issue in the Address Bar component. This vulnerability was fixed in Firefox 142 and Firefox ESR 140.2.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Version	Status	Constraints
unspecified	affected	<142

n/a

Version	Status	Constraints
unspecified	affected	<140.2

Product	Package	State	Advisory
Red Hat Enterprise Linux 10	firefox	Not affected	n/a
Red Hat Enterprise Linux 10	rhel10/firefox-flatpak	Not affected	n/a
Red Hat Enterprise Linux 6	firefox	Not affected	n/a
Red Hat Enterprise Linux 7	firefox	Not affected	n/a
Red Hat Enterprise Linux 8	firefox	Not affected	n/a
Red Hat Enterprise Linux 9	firefox	Not affected	n/a

Red Hat statement

Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

0.26% 0.00260

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00260

2025–2026

Table of values (3 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.26% (0.00260)	16.01th	v5 (v2026.06.15)
Jun 15, 2026	0.23% (0.00231)	13.69th	v5 (v2026.06.15)
Aug 20, 2025	0.02% (0.00017)	2.43th	v4 (v2025.03.14)

Weaknesses (1)

CWE-451

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2025-9183		Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1976102		Issue TrackingPermissions Required
https://bugzilla.redhat.com/show_bug.cgi?id=2389582		Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2025-9183
https://www.cve.org/CVERecord?id=CVE-2025-9183
https://www.mozilla.org/security/advisories/mfsa2025-64/		Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2025-67/		Vendor Advisory