When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header, only the last link is shown when hovering over any attachment. Although the correct link is used on click, the misleading hover text could trick users into downloading content from untrusted sources. This vulnerability affects Thunderbird < 137.0.2 and Thunderbird < 128.9.2.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://bugzilla.mozilla.org/show_bug.cgi?id=1958385 | Permissions Required |
| https://www.mozilla.org/security/advisories/mfsa2025-26/ | Vendor Advisory |
| https://www.mozilla.org/security/advisories/mfsa2025-27/ | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
13 Jun 2025, 18:51
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* | |
| First Time |
Mozilla thunderbird
Mozilla |
|
| References | () https://www.mozilla.org/security/advisories/mfsa2025-26/ - Vendor Advisory | |
| References | () https://bugzilla.mozilla.org/show_bug.cgi?id=1958385 - Permissions Required | |
| References | () https://www.mozilla.org/security/advisories/mfsa2025-27/ - Vendor Advisory |
15 Apr 2025, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-04-15 15:16
Updated : 2025-06-13 18:51
NVD link : CVE-2025-3523
Mitre link : CVE-2025-3523
JSON object : View
Products Affected
mozilla
- thunderbird
CWE
No CWE.