CVE-2025-4088: Mozilla Firefox CSRF Vulnerability

CVE-2025-4088 Overview

CVE-2025-4088 is a Cross-Site Request Forgery [CWE-352] vulnerability affecting Mozilla Thunderbird and Mozilla Firefox. The flaw allowed malicious sites to use HTTP redirects to send credentialed requests to arbitrary endpoints on any site that had previously invoked the Storage Access API. This behavior enabled cross-origin CSRF attacks against sites relying on the Storage Access API for cookie access decisions. Mozilla addressed the issue in Firefox 138 and Thunderbird 138.

Critical Impact
Attackers can trigger authenticated cross-origin requests on behalf of a victim to any site that has invoked the Storage Access API, enabling CSRF against sensitive endpoints.

Affected Products

Mozilla Firefox versions prior to 138
Mozilla Thunderbird versions prior to 138
Web applications relying on the Storage Access API for cookie access decisions

Discovery Timeline

2025-04-29 - CVE-2025-4088 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-4088

Vulnerability Analysis

The vulnerability resides in how Firefox and Thunderbird handled cross-origin redirects after a site invoked the Storage Access API. When a page requested storage access, the browser incorrectly extended credentialed request behavior to redirect targets. A malicious site could chain a redirect to any endpoint on a domain that had previously called document.requestStorageAccess(), and the browser would attach the victim's cookies to that request. This defeats the same-origin protections that CSRF defenses typically rely on. The result is a state-changing request executed with the victim's authenticated session on an unrelated origin.

Root Cause

The root cause is improper enforcement of origin boundaries during redirect handling in the Storage Access API implementation. The browser treated the redirect target as eligible for credentialed access based on the initiating site's storage access state, rather than re-evaluating the destination origin. This violates the isolation guarantee that the Storage Access API is designed to provide.

Attack Vector

Exploitation requires the victim to visit an attacker-controlled page. No user interaction beyond navigation is needed. The attacker page issues a request that redirects to a target endpoint on a domain that has invoked the Storage Access API. The browser follows the redirect and includes cookies, allowing the attacker to trigger authenticated actions such as account changes, transactions, or data modification.

No public proof-of-concept code is available for this issue. Refer to Mozilla Bug Report #1953521 for technical details.

Detection Methods for CVE-2025-4088

Indicators of Compromise

Unexpected state-changing HTTP requests in web application logs originating from cross-origin Referer headers
Authenticated POST or PUT requests immediately following a redirect chain from an unrelated third-party domain
User agent strings identifying Firefox or Thunderbird versions below 138 in server access logs

Detection Strategies

Inspect server-side request logs for authenticated actions preceded by redirects from unfamiliar origins
Correlate Storage Access API grants with subsequent cross-origin credentialed requests
Monitor endpoint telemetry for Firefox and Thunderbird processes running vulnerable versions

Monitoring Recommendations

Enforce and alert on missing or invalid CSRF tokens at sensitive endpoints
Track browser version inventory across the fleet and flag hosts running Firefox or Thunderbird below version 138
Log and review Referer and Origin headers on state-changing requests for anomalous cross-origin patterns

How to Mitigate CVE-2025-4088

Immediate Actions Required

Upgrade Mozilla Firefox to version 138 or later on all managed endpoints
Upgrade Mozilla Thunderbird to version 138 or later on all managed endpoints
Audit web applications for CSRF token enforcement on all state-changing endpoints, especially those invoking the Storage Access API

Patch Information

Mozilla released fixes in Firefox 138 and Thunderbird 138. Details are published in the Mozilla Security Advisory MFSA-2025-28 and Mozilla Security Advisory MFSA-2025-31. Administrators should deploy the vendor updates through standard software management channels.

Workarounds

Enforce anti-CSRF tokens with the SameSite=Strict or SameSite=Lax cookie attribute on session cookies
Require re-authentication or step-up verification for sensitive state-changing operations
Restrict use of the Storage Access API to trusted embedders and validate Origin headers on all credentialed endpoints

bash

# Example: enforce SameSite and CSRF header validation at the reverse proxy
# nginx snippet
add_header Set-Cookie "sessionid=$cookie_sessionid; Path=/; Secure; HttpOnly; SameSite=Strict";
if ($http_origin !~* ^https://(www\.)?example\.com$) {
    return 403;
}