CVE-2025-8038: CSP frame-src was not correctly enforced for paths
Firefox ignored paths when checking the validity of navigations in a frame.
Other sources
Thunderbird ignored paths when checking the validity of navigations in a frame.
— Mozilla
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 140.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 141 - Upgrade
Upgrade
Mozilla Firefox / Firefox ESR / Thunderbirdto a version that resolves this vulnerability.Fixed in 141 - Upgrade
Upgrade
Mozilla Firefox ESRto a version that resolves this vulnerability.Fixed in 140.1 - Upgrade
Upgrade
Mozilla Thunderbirdto a version that resolves this vulnerability.Fixed in 141 - Upgrade
Upgrade
Mozilla Thunderbirdto a version that resolves this vulnerability.Fixed in 140.1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-8038?
CVE-2025-8038 has been classified with a moderate severity level.
How do I fix CVE-2025-8038?
To fix CVE-2025-8038, update your Firefox to version 141 or Firefox ESR to version 140.2 or later.
What does CVE-2025-8038 affect?
CVE-2025-8038 affects versions of Mozilla Firefox and Firefox ESR prior to 141 and 140.2 respectively.
What type of vulnerability is CVE-2025-8038?
CVE-2025-8038 is a navigation validation vulnerability in Firefox.
Was CVE-2025-8038 reported or fixed recently?
CVE-2025-8038 was reported and fixed in a recent advisory aimed at improving Firefox's security.