CVE-2025-1019: Fullscreen notification not properly displayed
The z-order of the browser windows could be manipulated to hide the fullscreen notification. This could potentially be leveraged to perform a spoofing attack. This vulnerability was fixed in Firefox 135 and Thunderbird 135.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 135 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 135 - Upgrade
Upgrade
ubuntu/firefoxto a version that resolves this vulnerability.Fixed in 135.0+build2-0ubuntu0.20.04.1 - Upgrade
Upgrade
ubuntu/thunderbirdto a version that resolves this vulnerability.Fixed in 1:140.7.1+build1-0ubuntu0.22.04.1 - Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 159.0-1
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-1019?
CVE-2025-1019 has a medium severity rating due to its potential to enable spoofing attacks.
How can I mitigate CVE-2025-1019?
To mitigate CVE-2025-1019, users should upgrade to the latest version of Mozilla Thunderbird or Firefox beyond version 135.
What does CVE-2025-1019 exploit?
CVE-2025-1019 exploits the manipulation of the z-order of browser windows to hide fullscreen notifications.
Who is affected by CVE-2025-1019?
CVE-2025-1019 affects users of Mozilla Thunderbird and Mozilla Firefox versions prior to 135.
Can CVE-2025-1019 lead to any security breaches?
Yes, CVE-2025-1019 can potentially lead to security breaches through spoofing attacks.