VulnerabilityModified
CVE-2025-6429
This could have bypassed website security checks that restricted which domains users were allowed to embed.
MEDIUM 6.5EPSS 0.31%
Does this matter?
Lower severity and a low EPSS score (0.31%). Track it; it rarely justifies an emergency change on its own.
Description
Firefox could have incorrectly parsed a URL and rewritten it to the youtube.com domain when parsing the URL specified in an `embed` tag. This could have bypassed website security checks that restricted which domains users were allowed to embed. This vulnerability was fixed in Firefox 140, Firefox ESR 128.12, Thunderbird 140, and Thunderbird 128.12.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
- EPSS
- 0.31% probability · 24th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-116
- Affected
- mozilla/firefox
- Source
- security@mozilla.org
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1970658Permissions Required
- https://www.mozilla.org/security/advisories/mfsa2025-51/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2025-53/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2025-54/
- https://www.mozilla.org/security/advisories/mfsa2025-55/
- https://lists.debian.org/debian-lts-announce/2025/06/msg00029.html
- https://lists.debian.org/debian-lts-announce/2025/07/msg00002.html
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.