VulnerabilityModified

CVE-2025-6427

An attacker was able to bypass the `connect-src` directive of a Content Security Policy by manipulating subdocuments.

CRITICAL 9.1EPSS 0.32%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.32%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

An attacker was able to bypass the `connect-src` directive of a Content Security Policy by manipulating subdocuments. This would have also hidden the connections from the Network tab in Devtools. This vulnerability was fixed in Firefox 140 and Thunderbird 140.

CVSS 3.1: 9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS: 0.32% probability · 25th percentile
CISA KEV: Not listed
Weakness: CWE-693
Affected: mozilla/firefox
Source: security@mozilla.org

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1966927Permissions Required
https://www.mozilla.org/security/advisories/mfsa2025-51/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2025-54/

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.