CVE-2025-3033: Mozilla Firefox Information Disclosure Flaw

CVE-2025-3033 Overview

CVE-2025-3033 is a high-severity vulnerability in Mozilla Firefox and Thunderbird on Windows. When a user selects a malicious Windows .url shortcut from the local filesystem through a file picker, the browser can upload an unexpected file instead of the one the user intended. The flaw is categorized under CWE-73: External Control of File Name or Path and stems from how Firefox resolves .url shortcut targets during file selection. Only Firefox and Thunderbird on Windows are affected. Mozilla resolved the issue in Firefox 137 and Thunderbird 137.

Critical Impact
A malicious .url shortcut placed on a victim's filesystem can cause Firefox to upload an attacker-chosen file, exposing sensitive local data through web upload forms.

Affected Products

Mozilla Firefox on Windows prior to version 137
Mozilla Thunderbird on Windows prior to version 137
Other operating system builds of Firefox and Thunderbird are not affected

Discovery Timeline

2025-04-01 - CVE-2025-3033 published to NVD
2025-04-01 - Mozilla publishes advisories MFSA-2025-20 and MFSA-2025-23 with fixes in Firefox 137 and Thunderbird 137
2026-04-13 - Last updated in NVD database

Technical Details for CVE-2025-3033

Vulnerability Analysis

The vulnerability resides in the Windows-specific file picker handling within Firefox and Thunderbird. When a user navigates to a web upload control and selects a Windows Internet Shortcut file (.url), Firefox does not treat the shortcut as the literal file to upload. Instead, the browser follows the shortcut target. An attacker who can plant a .url file on the victim's machine, or trick the user into saving one, can craft the shortcut so that it resolves to a sensitive local file the user never intended to expose.

The defect maps to CWE-73: External Control of File Name or Path. The application accepts a filename whose target is controlled by an external party, then performs an upload operation against the resolved path. The user-facing dialog still displays the original .url selection, so the substitution is not visible at upload time.

Root Cause

The root cause is improper validation of selected file objects in the Windows file dialog code path. Firefox dereferences .url shortcuts during the upload pipeline rather than uploading the shortcut file itself or refusing to resolve it. The technical analysis is tracked in Mozilla Bug Report #1950056.

Attack Vector

Exploitation requires the attacker to place a crafted .url file on the victim's filesystem, typically through a prior download, an email attachment opened in Thunderbird, or a shared folder. The attacker then induces the user to interact with a web form that triggers a file upload dialog and selects the malicious shortcut. The browser uploads the shortcut's target file to an attacker-controlled endpoint. No user interaction beyond standard file selection is required, and no special privileges are needed.

No public proof-of-concept code is available for CVE-2025-3033. Technical details are documented in Mozilla Bug Report #1950056.

Detection Methods for CVE-2025-3033

Indicators of Compromise

Outbound HTTP/HTTPS POST requests from firefox.exe or thunderbird.exe containing multipart upload bodies that reference local file paths the user did not knowingly select
Recently created or modified .url files in user-writable directories such as Downloads, Desktop, or %TEMP% that contain URL=file:// entries pointing to sensitive paths
File access events where Firefox or Thunderbird reads sensitive files such as NTUSER.DAT, SSH keys, or credential stores immediately after a file picker interaction

Detection Strategies

Inspect .url files on endpoints for URL=file:// schemes resolving to local paths, which is unusual for legitimate internet shortcuts
Correlate Firefox or Thunderbird process file reads with web upload network activity to surface mismatches between user-selected files and uploaded content
Audit installed Firefox and Thunderbird versions across the fleet and flag any Windows hosts running versions prior to 137

Monitoring Recommendations

Enable file integrity monitoring on directories that hold credentials, tokens, and configuration secrets accessed by user-context processes
Log browser child process activity and outbound upload destinations through EDR telemetry for retrospective hunting
Alert on .url files dropped by email clients, messaging applications, or browser downloads when the target is a local file:// path

How to Mitigate CVE-2025-3033

Immediate Actions Required

Upgrade Mozilla Firefox to version 137 or later on all Windows endpoints
Upgrade Mozilla Thunderbird to version 137 or later on all Windows endpoints
Sweep user profile directories for suspicious .url files containing file:// targets and remove them

Patch Information

Mozilla fixed CVE-2025-3033 in Firefox 137 and Thunderbird 137. Refer to Mozilla Security Advisory MFSA-2025-20 for Firefox and Mozilla Security Advisory MFSA-2025-23 for Thunderbird. Apply vendor updates through enterprise software distribution or the built-in updater. Verify the installed version via Help > About Firefox or the equivalent Thunderbird menu after deployment.

Workarounds

If immediate patching is not possible, restrict user ability to upload arbitrary local files in high-risk web applications through browser policy or application controls
Block delivery of .url attachments at the email gateway to reduce the chance of malicious shortcuts reaching user filesystems
Educate users to avoid selecting unfamiliar .url files in browser upload dialogs, since the file picker preview does not reveal the resolved target

bash

# Verify installed Firefox version on Windows endpoints
"C:\Program Files\Mozilla Firefox\firefox.exe" --version

# Example Group Policy ADMX setting to disable manual update deferral
# Computer Configuration > Policies > Administrative Templates > Mozilla > Firefox
# Enable: "Disable App Update" = Disabled
# Enable: "Application Update Background Service" = Enabled