CVE-2025-3523: User Interface (UI) Misrepresentation of attachment URL
When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header, only the last link is shown when hovering over any attachment. Although the correct link is used on click, the misleading hover text could trick users into downloading content from untrusted sources.
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-3523?
CVE-2025-3523 is classified as a moderate severity vulnerability due to the potential for user deception.
How does CVE-2025-3523 affect users?
CVE-2025-3523 misleads users by displaying only the last attachment link in the hover text, which could lead to the unintentional downloading of malicious content.
Can CVE-2025-3523 be exploited easily?
Exploitation of CVE-2025-3523 requires user interaction as it relies on clicking the attachment links.
What versions of Thunderbird are affected by CVE-2025-3523?
CVE-2025-3523 affects Mozilla Thunderbird versions prior to 137.0.2 and 128.9.2.
How do I fix CVE-2025-3523?
To mitigate CVE-2025-3523, update to the latest version of Mozilla Thunderbird that addresses this vulnerability.