CVE-2025-10536: Mozilla Firefox Cache Information Leak

CVE-2025-10536 Overview

CVE-2025-10536 is an information disclosure vulnerability in the Networking: Cache component of Mozilla Firefox and Thunderbird. The flaw allows a local attacker to access sensitive data cached by the browser or mail client. Mozilla addressed the issue in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3. The vulnerability is categorized under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor). No public proof-of-concept exploit or in-the-wild exploitation has been reported. Debian LTS also shipped fixed packages through security announcements in September 2025.

Critical Impact
A local actor can retrieve cached network data from Firefox or Thunderbird, exposing confidential information handled by the browser cache without requiring user interaction.

Affected Products

Mozilla Firefox prior to version 143
Mozilla Firefox ESR prior to 140.3
Mozilla Thunderbird prior to 143 and prior to 140.3

Discovery Timeline

2025-09-16 - CVE-2025-10536 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10536

Vulnerability Analysis

The defect resides in the Networking: Cache subsystem shared between Firefox and Thunderbird. The cache stores HTTP responses, resource metadata, and related state on disk to accelerate subsequent requests. Improper handling of cached content lets a local attacker read data that should remain confined to the profile owner's browsing or mail session.

Because the exposure occurs through the cache layer, the sensitive data may include response bodies, headers, or referenced resources associated with authenticated sessions. The confidentiality impact is high while integrity and availability are unaffected. The issue does not require privileges or user interaction to be triggered locally.

Root Cause

The root cause is an information exposure weakness [CWE-200] in the caching logic. The component fails to enforce adequate isolation or clearing of cached data, allowing another local process or user context to retrieve content that should be scoped to the original requestor. Mozilla's advisories MFSA-2025-73, MFSA-2025-75, MFSA-2025-77, and MFSA-2025-78 confirm the fix and version boundaries.

Attack Vector

Exploitation requires local access to the system running Firefox or Thunderbird. An attacker with a foothold on the endpoint reads cache artifacts to recover data from the victim's browsing or mail activity. The attack does not require authentication or user interaction and executes within the local security scope. See the Mozilla Bug Report #1981502 for technical context.

No verified public exploit code exists for CVE-2025-10536. Refer to the Mozilla Security Advisory MFSA-2025-73 for authoritative technical details.

Detection Methods for CVE-2025-10536

Indicators of Compromise

Unexpected read access to Firefox or Thunderbird profile cache directories such as ~/.cache/mozilla/firefox/ and %LOCALAPPDATA%\Mozilla\Firefox\Profiles\.
Presence of Firefox or Thunderbird installations at versions below 143 (or ESR below 140.3) on managed endpoints.
Unusual local processes enumerating browser cache files outside the parent Firefox or Thunderbird process tree.

Detection Strategies

Inventory Firefox and Thunderbird versions across the estate and flag any host running versions earlier than the fixed releases.
Monitor endpoint telemetry for non-browser processes opening files under Mozilla cache paths.
Correlate local logon events with cache-directory file access to identify cross-user reads on shared systems.

Monitoring Recommendations

Enable file integrity and access monitoring on Mozilla profile and cache directories.
Alert on command-line utilities (cat, type, xcopy, robocopy, PowerShell) accessing browser cache locations.
Track patch compliance for Mozilla applications through vulnerability management dashboards on a weekly cadence.

How to Mitigate CVE-2025-10536

Immediate Actions Required

Upgrade Firefox to 143 or later and Firefox ESR to 140.3 or later on all endpoints.
Upgrade Thunderbird to 143 or later, or to 140.3 or later for the ESR channel.
Apply distribution patches for Debian and other Linux vendors, referencing the Debian LTS Announcement #20 and Debian LTS Announcement #26.

Patch Information

Mozilla shipped fixes in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3. Full details are in Mozilla Security Advisory MFSA-2025-75, MFSA-2025-77, and MFSA-2025-78. Enterprise administrators should push updates through managed software distribution and validate versions post-deployment.

Workarounds

Restrict local access to endpoints running vulnerable Firefox or Thunderbird versions until patches are applied.
Enforce per-user filesystem permissions on Mozilla profile directories to prevent cross-account reads.
Configure Firefox and Thunderbird to clear the cache on shutdown while awaiting upgrade windows.

bash

# Configuration example: enforce restrictive permissions on Firefox profile
chmod -R 700 ~/.mozilla/firefox
chmod -R 700 ~/.cache/mozilla/firefox