CVE-2025-1015 Overview
CVE-2025-1015 is a cross-site scripting (XSS) vulnerability in Mozilla Thunderbird affecting Address Book URI fields. The flaw stems from unsanitized links stored in address book entries, including the Other field within the Instant Messaging section. An attacker can craft and export an address book containing a malicious payload. When a victim imports the address book and clicks the link, Thunderbird opens a web page that executes unprivileged JavaScript in the application context. Mozilla fixed the issue in Thunderbird 128.7 and Thunderbird 135. The vulnerability is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation).
Critical Impact
Importing a malicious address book and clicking an embedded link triggers unprivileged JavaScript execution inside Thunderbird, exposing user data and enabling further client-side attacks.
Affected Products
- Mozilla Thunderbird versions prior to 128.7 (ESR)
- Mozilla Thunderbird versions prior to 135
- Address Book component handling URI fields
Discovery Timeline
- 2025-02-04 - CVE-2025-1015 published to NVD
- 2026-04-13 - Last updated in NVD database
Technical Details for CVE-2025-1015
Vulnerability Analysis
The vulnerability resides in Thunderbird's Address Book functionality. URI fields accept link content without proper sanitization or validation. Attackers can embed crafted URIs, such as javascript: schemes or links pointing to attacker-controlled pages, inside contact fields. The Other field of the Instant Messaging section is one confirmed injection point.
When the recipient imports the address book and interacts with the contact entry, Thunderbird treats the stored value as a clickable link. Clicking the link opens the URI inside Thunderbird's embedded browser context. The resulting page executes JavaScript without the privileges of chrome-level code, but still within the email client. EPSS data indicates a meaningful probability of exploitation activity for this issue.
Root Cause
The root cause is missing input sanitization on URI fields in the address book import and rendering paths. Thunderbird stored attacker-supplied strings as trusted link targets and rendered them as anchors without filtering dangerous schemes or scripting payloads. This violates standard output-encoding requirements for [CWE-79].
Attack Vector
Exploitation requires user interaction in two stages. First, the victim must import an attacker-supplied address book file. Second, the victim must click the malicious link within the imported contact. The attack vector is network-based because address books are commonly distributed by email, messaging, or file shares. No authentication or elevated privileges are required from the attacker.
The vulnerability is described in prose because no verified public proof-of-concept code is available. Technical specifics are documented in Mozilla Bug Report #1939458 and Mozilla Security Advisory MFSA-2025-10.
Detection Methods for CVE-2025-1015
Indicators of Compromise
- Address book files (.vcf, .ldif, .mab) received from untrusted sources containing javascript:, data:, or other non-standard URI schemes in contact fields.
- Thunderbird process spawning unexpected child processes or outbound network connections immediately after a user opens a contact entry.
- Newly imported contacts containing populated Other Instant Messaging fields with embedded HTML or script content.
Detection Strategies
- Inspect imported address book files for URI fields containing scheme handlers other than http, https, mailto, or tel.
- Audit Thunderbird profile directories (abook.sqlite, history.sqlite) for contact records with suspicious URI payloads.
- Correlate email gateway logs to identify address book attachments delivered alongside social-engineering messages.
Monitoring Recommendations
- Monitor endpoints for Thunderbird versions below 128.7 ESR or 135 and flag them for upgrade.
- Alert on unusual outbound HTTP requests originating from the Thunderbird process shortly after contact-related UI interactions.
- Track address book import events through endpoint telemetry and review them against allowlisted sources.
How to Mitigate CVE-2025-1015
Immediate Actions Required
- Upgrade all Thunderbird installations to version 128.7 ESR or 135 or later.
- Instruct users not to import address book files received from untrusted or unverified senders.
- Review existing address books for entries containing suspicious URIs and remove offending contacts.
Patch Information
Mozilla released fixes in Thunderbird 128.7 and Thunderbird 135. Refer to Mozilla Security Advisory MFSA-2025-10 and Mozilla Security Advisory MFSA-2025-11 for full advisory details and download links. Administrators distributing Thunderbird through enterprise channels should push the updated build to all managed endpoints.
Workarounds
- Disable address book import from end-user workflows where business needs do not require it.
- Apply email gateway rules to quarantine attachments with .vcf, .ldif, or .mab extensions from external senders.
- Educate users to avoid clicking links inside imported contacts until upgrades are complete.
# Verify the installed Thunderbird version meets the patched baseline
thunderbird --version
# Expected output should be 128.7 (ESR) or 135 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
