Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2025-1936

jar: URLs retrieve local file content packaged in a ZIP archive. The null and everything after it was ignored when retrieving the content from the archive, but the fake extension after the null was used to determine the type of content. This could have been used to hide code in a web extension disguised as something else like an image. This vulnerability affects Firefox < 136, Firefox ESR < 128.8, Thunderbird < 136, and Thunderbird < 128.8.

Published

2025-03-04T14:15:38.500

Last Modified

2025-06-24T17:08:27.197

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 7.3 (HIGH)

Weaknesses

Type: Secondary
CWE-158

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	mozilla	firefox	< 128.8.0	Yes
Application	mozilla	firefox	< 136.0	Yes
Application	mozilla	thunderbird	< 128.8.0	Yes
Application	mozilla	thunderbird	< 136.0	Yes

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1940027 Permissions Required ([email protected])
https://www.mozilla.org/security/advisories/mfsa2025-14/ Vendor Advisory ([email protected])
https://www.mozilla.org/security/advisories/mfsa2025-16/ Vendor Advisory ([email protected])
https://www.mozilla.org/security/advisories/mfsa2025-17/ Vendor Advisory ([email protected])
https://www.mozilla.org/security/advisories/mfsa2025-18/ Vendor Advisory ([email protected])