CVE-2025-11712: Mozilla Firefox XSS Vulnerability

CVE-2025-11712 Overview

CVE-2025-11712 is a content-type override vulnerability in Mozilla Firefox and Thunderbird. A malicious page can use the type attribute of an OBJECT tag to override the browser's default handling of a web resource served without a Content-Type header. When a target site serves user-controlled files without a content-type header, this behavior can contribute to a Cross-Site Scripting (XSS) condition. The issue is classified under [CWE-116] Improper Encoding or Escaping of Output. Mozilla fixed the flaw in Firefox 144, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4.

Critical Impact
Attackers can bypass browser content-type inference to execute script in the context of a vulnerable site that hosts user-uploaded files without content-type headers, enabling stored or reflected XSS.

Affected Products

Mozilla Firefox versions prior to 144
Mozilla Firefox ESR versions prior to 140.4
Mozilla Thunderbird versions prior to 144 and prior to 140.4

Discovery Timeline

2025-10-14 - CVE-2025-11712 published to the National Vulnerability Database (NVD)
2025-10-15 - Debian LTS security announcement issued
2025-10-31 - Additional Debian LTS security announcement issued
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11712

Vulnerability Analysis

The vulnerability resides in how Firefox handles the type attribute on HTML OBJECT elements when a referenced resource is delivered without a Content-Type response header. Under normal circumstances, browsers infer or reject a resource based on server-declared MIME type. With this flaw, an attacker-controlled OBJECT tag can influence how the resource is interpreted by supplying a chosen type value. If the embedded resource is hosted on a site that permits arbitrary file uploads and returns those files without a content-type header, an attacker can coerce script execution in the origin of that host site. The result is a same-origin XSS condition against the file-hosting site, allowing session theft, unauthorized actions, and content manipulation.

Root Cause

The root cause is improper output encoding and MIME-type resolution logic ([CWE-116]). Firefox trusted the attacker-supplied type attribute value to override default content-sniffing behavior when the origin server omitted a Content-Type header, rather than applying safe fallback handling.

Attack Vector

Exploitation requires user interaction. A victim visits a malicious page that embeds an OBJECT element referencing a file on a target site that stores user-supplied content and serves it without a content-type header. The malicious page sets a type attribute that causes the browser to render the referenced file as an executable script resource in the target site's origin. See the Mozilla Bug Report 1979536 for the technical bug tracking details. No exploitation code is publicly available and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-11712

Indicators of Compromise

Web server access logs showing requests for user-uploaded files where responses omit a Content-Type header.
Referrer headers indicating that requests to uploaded content originate from unexpected third-party domains embedding OBJECT tags.
Browser telemetry showing Firefox versions below 144 or ESR 140.4 in the environment.

Detection Strategies

Audit web applications for endpoints that serve user-uploaded content and confirm each response includes a correct Content-Type header.
Inspect HTML content across managed sites for unexpected <object> elements referencing external origins.
Use browser inventory tools to identify endpoints running unpatched Firefox or Thunderbird builds.

Monitoring Recommendations

Monitor outbound HTTP responses from file-serving applications for missing Content-Type headers using a reverse proxy or WAF policy.
Alert on new script-like requests to file storage paths (for example, /uploads/) that originate from third-party referrers.
Track browser version compliance through endpoint management platforms and flag hosts on vulnerable Firefox or Thunderbird builds.

How to Mitigate CVE-2025-11712

Immediate Actions Required

Upgrade Firefox to version 144 or later and Firefox ESR to 140.4 or later on all managed endpoints.
Upgrade Thunderbird to version 144 or later, or to 140.4 or later on ESR channels.
Apply the corresponding Debian LTS packages referenced in the Debian LTS Announcement 15 Oct 2025 and Debian LTS Announcement 31 Oct 2025.
Review any internally hosted file-serving applications and enforce explicit Content-Type headers on all responses.

Patch Information

Mozilla addressed CVE-2025-11712 in Firefox 144, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4. Full advisory details are available in Mozilla Security Advisory MFSA-2025-81, MFSA-2025-83, MFSA-2025-84, and MFSA-2025-85.

Workarounds

Configure web servers hosting user-supplied content to always emit a correct Content-Type header, defaulting to application/octet-stream when unknown.
Add the X-Content-Type-Options: nosniff response header to prevent MIME sniffing on file-serving endpoints.
Serve untrusted user content from a separate sandbox origin to isolate any residual XSS impact from primary application domains.

bash

# Example nginx configuration to enforce safe content-type handling
location /uploads/ {
    default_type application/octet-stream;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Content-Disposition "attachment" always;
}