CVE-2025-1013: Mozilla Firefox Race Condition Vulnerability

CVE-2025-1013 Overview

CVE-2025-1013 is a race condition [CWE-362] in Mozilla Firefox and Thunderbird that can cause private browsing tabs to be opened in normal (non-private) browsing windows. When triggered, browsing activity intended to remain isolated from the standard profile is instead persisted to history, cache, and cookie stores. This creates a privacy leak that undermines the security guarantees users expect from private browsing mode. Mozilla addressed the flaw in Firefox 135, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.

Critical Impact
A timing flaw in tab creation logic can route private browsing sessions into standard windows, leaking URLs, cookies, and cached data to the persistent user profile.

Affected Products

Mozilla Firefox versions prior to 135
Mozilla Firefox ESR versions prior to 128.7
Mozilla Thunderbird versions prior to 135 and prior to 128.7

Discovery Timeline

2025-02-04 - CVE-2025-1013 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-1013

Vulnerability Analysis

The vulnerability is a race condition in the browser code that governs how new tabs are associated with a browsing context (private or normal). Under specific timing conditions during tab creation, the flag marking a tab as private can be evaluated before the correct browsing context has been established. The tab is then attached to the standard browsing window instead of the private one.

As a result, network requests, cookies, cached resources, and history entries generated inside what the user believes is a private session are written to the persistent profile. The issue affects both Firefox and Thunderbird because they share the underlying Gecko browsing infrastructure.

Root Cause

The root cause is unsynchronized access to state that determines the privacy status of a newly created tab. Concurrent code paths handling tab creation and window assignment do not enforce ordering, producing a time-of-check to time-of-use condition classified as [CWE-362].

Attack Vector

Exploitation requires triggering the race window during tab opening. This can occur through user interaction with links, scripted window.open calls, or content that spawns multiple tabs in rapid succession. Successful triggering causes private session data to be recorded to the standard profile, which an attacker with local access or forensic capability could later recover.

No verified proof-of-concept code has been published. Technical details are documented in Mozilla Bug Report #1932555.

Detection Methods for CVE-2025-1013

Indicators of Compromise

Unexpected entries in places.sqlite (Firefox history database) that correspond to sessions users intended to conduct in private mode.
Cookies or cached files in the standard profile matching domains only visited during private browsing.
Firefox or Thunderbird versions below the fixed releases (135, ESR 128.7, Thunderbird 128.7 or 135) reported by asset inventory.

Detection Strategies

Inventory endpoints for outdated Mozilla Firefox and Thunderbird installations using software asset management or endpoint telemetry.
Correlate browser version data with the fixed builds listed in Mozilla Security Advisory MFSA-2025-07.
Review Debian and other Linux distribution package inventories against the Debian LTS Announcement.

Monitoring Recommendations

Track browser version telemetry across managed endpoints and flag hosts running vulnerable Firefox or Thunderbird builds.
Monitor enterprise update channels to confirm that Firefox ESR 128.7 and Thunderbird 128.7 have been deployed on all supported systems.
Include Mozilla advisory feeds in vulnerability management processes to catch related privacy issues promptly.

How to Mitigate CVE-2025-1013

Immediate Actions Required

Upgrade Mozilla Firefox to version 135 or later on all endpoints.
Upgrade Firefox ESR deployments to 128.7 or later to maintain the extended support track.
Upgrade Thunderbird to 128.7 or 135 depending on the deployed branch.
Apply Linux distribution updates that ship the patched packages, including those referenced in the Debian LTS announcement.

Patch Information

Mozilla resolved the race condition in Firefox 135, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135. Details are published in Mozilla Security Advisory MFSA-2025-07, MFSA-2025-09, MFSA-2025-10, and MFSA-2025-11.

Workarounds

Avoid opening private browsing tabs concurrently with actions that spawn new standard tabs until patches are applied.
Use a separate Firefox profile dedicated to sensitive browsing so that any leaked state remains contained.
Where centrally managed, enforce browser updates through enterprise policy to close the exposure window quickly.

bash

# Example: verify installed Firefox version on Linux endpoints
firefox --version

# Example: upgrade Firefox and Thunderbird on Debian-based systems
sudo apt update && sudo apt install --only-upgrade firefox-esr thunderbird