CVE-2025-3029: URL Bar Spoofing via non-BMP Unicode characters
A crafted URL containing specific Unicode characters could have hidden the true origin of the page, resulting in a potential spoofing attack. This vulnerability was fixed in Firefox 137, Firefox ESR 128.9, Thunderbird 137, and Thunderbird 128.9.
Other sources
A crafted URL containing specific Unicode characters could have hidden the true origin of the page, resulting in a potential spoofing attack. This vulnerability affects Firefox < 137, Firefox ESR < 128.9, Thunderbird < 137, and Thunderbird ESR < 128.9.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 137 - Upgrade
Upgrade
ubuntu/thunderbirdto a version that resolves this vulnerability.Fixed in 1:128.12.0+build1-0ubuntu0.22.04.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 137 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 128.9 - Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 160.0-1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 140.12.0esr-1~deb12u1Fixed in 153.7.0esr-1~deb12u1Fixed in 140.15.0esr-1~deb13u1Fixed in 153.7.0esr-1~deb13u1Fixed in 153.5.1esr-1Fixed in 153.7.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:140.12.0esr-1~deb12u1Fixed in 1:153.7.0esr-1~deb12u1Fixed in 1:140.12.0esr-1~deb13u1Fixed in 1:153.7.0esr-1~deb13u1Fixed in 1:153.5.0esr-1Fixed in 1:153.7.0esr-1 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 137 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 128.9 - Upgrade
Upgrade
Thunderbird ESRto a version that resolves this vulnerability.Fixed in 128.9
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-3029?
CVE-2025-3029 has been classified as a high severity vulnerability due to the risk of spoofing attacks.
How can I fix CVE-2025-3029?
To fix CVE-2025-3029, update your Mozilla Thunderbird or Firefox to the latest version beyond the vulnerable releases.
What versions of software are affected by CVE-2025-3029?
CVE-2025-3029 affects Thunderbird versions prior to 137, Thunderbird ESR versions prior to 128.9, Firefox versions prior to 137, and Firefox ESR versions prior to 128.9.
What type of attack does CVE-2025-3029 facilitate?
CVE-2025-3029 facilitates potential spoofing attacks by allowing crafted URLs to hide the true origin of a page.
Who is the vendor for CVE-2025-3029?
The vendor for CVE-2025-3029 is Mozilla, which produces both Thunderbird and Firefox.