CVE-2025-4085: Potential information leakage and privilege escalation in UITour actor
An attacker with control over a content process could potentially leverage the privileged UITour actor to leak sensitive information or escalate privileges. This vulnerability was fixed in Firefox 138 and Thunderbird 138.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 138 - Upgrade
Upgrade
ubuntu/thunderbirdto a version that resolves this vulnerability.Fixed in 1:140.7.1+build1-0ubuntu0.22.04.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 138 - Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 159.0-1 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 138
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-4085?
CVE-2025-4085 is classified as a high severity vulnerability due to its potential to leak sensitive information and escalate privileges.
How do I fix CVE-2025-4085?
To fix CVE-2025-4085, update Mozilla Firefox or Thunderbird to version 138 or later.
What types of software are affected by CVE-2025-4085?
CVE-2025-4085 affects Mozilla Firefox versions prior to 138 and Mozilla Thunderbird versions prior to 138.
What could an attacker exploit in CVE-2025-4085?
An attacker could exploit CVE-2025-4085 to leverage the privileged UITour actor for potentially leaking sensitive information.
What is the impact of CVE-2025-4085 on users?
The impact of CVE-2025-4085 on users may include unauthorized access to sensitive information and increased vulnerability to privilege escalation.