CVE-2025-8038: CSP frame-src was not correctly enforced for paths
Firefox ignored paths when checking the validity of navigations in a frame.
Other sources
Thunderbird ignored paths when checking the validity of navigations in a frame. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1.
— Ubuntu
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 140.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 141 - Upgrade
Upgrade
ubuntu/thunderbirdto a version that resolves this vulnerability.Fixed in 1:140.7.1+build1-0ubuntu0.22.04.1 - Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 159.0-1 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 141 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 140.1 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 141 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 140.1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-8038?
CVE-2025-8038 has been classified with a moderate severity level.
How do I fix CVE-2025-8038?
To fix CVE-2025-8038, update your Firefox to version 141 or Firefox ESR to version 140.2 or later.
What does CVE-2025-8038 affect?
CVE-2025-8038 affects versions of Mozilla Firefox and Firefox ESR prior to 141 and 140.2 respectively.
What type of vulnerability is CVE-2025-8038?
CVE-2025-8038 is a navigation validation vulnerability in Firefox.
Was CVE-2025-8038 reported or fixed recently?
CVE-2025-8038 was reported and fixed in a recent advisory aimed at improving Firefox's security.