CVE-2025-4090: Mozilla Firefox Information Disclosure Flaw

CVE-2025-4090 Overview

CVE-2025-4090 is an information disclosure vulnerability affecting Thunderbird for Android. The application logged potentially sensitive library locations through Android's Logcat diagnostic facility. Any application or process able to read Logcat output on the device could observe these paths and use them to inform further attacks against the Thunderbird process.

The issue is categorized under [CWE-532] (Insertion of Sensitive Information into Log File). Mozilla addressed the flaw in Firefox 138 and Thunderbird 138. No exploitation in the wild has been reported, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog.

Critical Impact
Local applications reading Android Logcat output can enumerate sensitive Thunderbird library paths, aiding reconnaissance for follow-on exploitation such as memory corruption or code injection.

Affected Products

Mozilla Thunderbird for Android (versions prior to 138)
Mozilla Firefox (versions prior to 138)
Mozilla Thunderbird (versions prior to 138)

Discovery Timeline

2025-04-29 - CVE-2025-4090 published to the National Vulnerability Database
2025-04-29 - Mozilla publishes advisories MFSA-2025-28 and MFSA-2025-31
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-4090

Vulnerability Analysis

The vulnerability stems from Thunderbird for Android writing internal library location data to the Android system log (Logcat). Logcat is a shared circular buffer that captures diagnostic messages emitted by the Android runtime and installed applications. Prior to Android 4.1, any application holding the READ_LOGS permission could read the buffer directly. On modern Android releases, Logcat is scoped to system components, developer tooling over Android Debug Bridge (adb), and the emitting process itself. Even so, logged data remains available to on-device attackers with physical access, debug-enabled devices, and companion applications operating with elevated privileges.

The logged information describes where Thunderbird loads its native libraries from within the app sandbox. Exposure of these paths reduces the effectiveness of Address Space Layout Randomization (ASLR) mitigations and simplifies reconnaissance for adversaries preparing exploits against Thunderbird's native code.

Root Cause

The root cause is diagnostic logging left enabled in production builds. Developer-oriented log statements emitted library path data intended for debugging without being gated behind a debug build flag or stripped from release artifacts. This is a common instance of [CWE-532], where sensitive process metadata is inadvertently persisted in a log sink accessible outside the intended trust boundary.

Attack Vector

Exploitation requires an attacker to observe Logcat output while Thunderbird for Android is running. This can occur through a companion malicious app abusing platform-specific logging channels, adb logcat on a developer-enabled device, or forensic access to a device. The vulnerability does not directly expose message contents, credentials, or account data. Instead, the disclosed paths serve as a building block for subsequent attacks targeting the Thunderbird process.

No public proof-of-concept exploit code is available. Mozilla's Bug 1929478 tracks the underlying report and the fix implemented in the 138 release train.

Detection Methods for CVE-2025-4090

Indicators of Compromise

Presence of Thunderbird for Android builds earlier than version 138 on managed mobile devices.
Logcat entries originating from the Thunderbird process containing native library file system paths.
Companion applications on the device requesting or holding logging-related permissions without a documented need.

Detection Strategies

Inventory mobile endpoints to identify installations of Thunderbird for Android below version 138 using mobile device management (MDM) reporting.
Review application-side log output during quality assurance testing for path disclosure patterns before promoting builds.
Correlate mobile threat defense telemetry with installed app versions to flag unpatched Mozilla clients.

Monitoring Recommendations

Track Mozilla security advisories MFSA-2025-28 and MFSA-2025-31 for related updates.
Alert on Android devices reporting adb debugging enabled in enterprise fleets, as this expands Logcat accessibility.
Monitor for installation of unsanctioned diagnostic or logging utilities on corporate mobile devices.

How to Mitigate CVE-2025-4090

Immediate Actions Required

Upgrade Thunderbird for Android to version 138 or later on all managed devices.
Upgrade desktop Mozilla Firefox and Thunderbird clients to version 138 or later to align with the same advisory cycle.
Disable adb debugging on production mobile endpoints to reduce Logcat exposure.
Audit installed Android applications for unnecessary access to system logging facilities.

Patch Information

Mozilla remediated CVE-2025-4090 in Firefox 138 and Thunderbird 138. Fix details are documented in Mozilla advisories MFSA-2025-28 and MFSA-2025-31, with implementation details tracked in Mozilla Bug 1929478. Deploy the update through Google Play, F-Droid, or your organization's managed app distribution channel.

Workarounds

Restrict installation of untrusted third-party applications that could read Logcat output on the same device.
Enforce MDM policies that block developer options and USB debugging on user-owned and corporate devices.
Where immediate patching is not possible, limit use of Thunderbird for Android to devices without other installed applications requesting elevated diagnostic permissions.

bash

# Configuration example: verify installed Thunderbird for Android version via adb
adb shell dumpsys package net.thunderbird.android | grep versionName

# Disable USB debugging on managed devices via MDM policy (example: Android Enterprise)
# Set the following restriction in your MDM console:
#   ensureVerifyAppsEnabled: true
#   debuggingFeaturesAllowed: false