CVE-2025-6433

Critical CVSS: 9.8

If a user visited a webpage with an invalid TLS certificate, and granted an exception, the webpage was able to provide a WebAuthn challenge that the user would be prompted to complete. This is in violation of the WebAuthN spec which requires "a secure transport established without errors". This vulnerability affects Firefox < 140 and Thunderbird < 140.

Vendor

Mozilla

Product

Firefox

CWE

CWE-295

Yayın Tarihi

2025-06-24 13:15:24

Güncelleme

2025-07-14 19:15:34

Source Identifier

security@mozilla.org

KEV Date Added

Kategoriler

CWE-295 Firefox CRITICAL Mozilla 2025

Referanslar

https://bugzilla.mozilla.org/show_bug.cgi?id=1954033 https://www.mozilla.org/security/advisories/mfsa2025-51/ https://www.mozilla.org/security/advisories/mfsa2025-54/

Benzer Kayıtlar

High

CVE-2026-5732

Incorrect boundary conditions, integer overflow in the Graphics: Text component. This vulnerability affects Firefox < 14…

High

CVE-2026-5733

Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability affects Firefox < 149.0.2 and Thunde…

Critical

CVE-2026-5734

Memory safety bugs present in Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Som…

Critical

CVE-2026-5735

Memory safety bugs present in Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corr…

Medium

CVE-2026-3889

Spoofing issue in Thunderbird. This vulnerability affects Thunderbird < 149 and Thunderbird < 140.9.

High

CVE-2026-4371

A malicious mail server could send malformed strings with negative lengths, causing the parser to read memory outside th…