CVE-2025-6425 Overview
CVE-2025-6425 is an information disclosure vulnerability [CWE-200] in Mozilla Firefox and Thunderbird. An attacker who enumerated resources from the WebCompat extension could obtain a persistent Universally Unique Identifier (UUID) that identifies the browser. The identifier persists across container tabs and between normal and private browsing modes, though not across separate profiles. This behavior enables cross-context browser fingerprinting and undermines the privacy guarantees users expect from private browsing and container isolation. Mozilla addressed the issue in Firefox 140, Firefox ESR 115.25, Firefox ESR 128.12, Thunderbird 140, and Thunderbird 128.12.
Critical Impact
A remote website can silently fingerprint a browser instance and correlate user activity across private browsing sessions and container tabs, defeating a core privacy control.
Affected Products
- Mozilla Firefox versions prior to 140
- Mozilla Firefox ESR prior to 115.25 and prior to 128.12
- Mozilla Thunderbird versions prior to 140 and prior to 128.12
Discovery Timeline
- 2025-06-24 - CVE-2025-6425 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-6425
Vulnerability Analysis
The vulnerability resides in the WebCompat WebExtension bundled with Firefox. WebCompat ships site-specific interventions that adjust page behavior to improve compatibility with sites that misbehave on Firefox. Web content could enumerate resources exposed by the extension and retrieve a stable identifier tied to the browser installation.
Because the identifier remained constant across contexts, a tracker embedded on multiple sites could link a user's activity in a container tab to activity in an unrelated normal or private window. Private browsing is expected to prevent such correlation by isolating storage, cookies, and site data. This leak bypasses that model entirely because the UUID is exposed by an internal extension resource rather than through conventional storage APIs.
The issue is classified as an Information Exposure vulnerability [CWE-200]. Only the confidentiality of a fingerprint-grade identifier is affected; there is no impact to integrity or availability.
Root Cause
The WebCompat extension exposed resources that were accessible to web content and contained or referenced a per-installation UUID. The identifier was generated once and reused across browsing contexts within a profile, so containers and private windows shared the same value.
Attack Vector
Exploitation requires a user to visit an attacker-controlled or attacker-influenced page. The page requests the extension's exposed resources, parses the UUID, and transmits it to a tracking backend. Repeat visits or cross-site embedding of the tracker allow correlation of activity that users assume is isolated by container or private browsing boundaries. No authentication or elevated privileges are required.
See the Mozilla Security Advisory MFSA-2025-51 and Mozilla Bug Report #1717672 for vendor technical details.
Detection Methods for CVE-2025-6425
Indicators of Compromise
- Outbound requests from browsers to third-party endpoints carrying UUID-shaped query parameters or POST fields following visits to unfamiliar sites.
- Web content requests targeting moz-extension:// resource URLs associated with the WebCompat extension.
- Repeat correlation of the same identifier value in analytics or advertising telemetry across container and private browsing sessions on the same host.
Detection Strategies
- Inventory browser versions across the fleet and flag Firefox and Thunderbird builds older than the fixed releases.
- Inspect proxy and DNS logs for requests to known fingerprinting or tracker domains from users on unpatched browsers.
- Use browser developer tools or network capture in test environments to confirm whether pages successfully retrieve WebCompat extension resources containing a UUID.
Monitoring Recommendations
- Ingest browser version telemetry into centralized logging and alert on hosts running Firefox or Thunderbird below the patched versions.
- Monitor egress web traffic for repeated identifiers correlating sessions that should be isolated by profile or container.
- Track Mozilla advisory feeds (MFSA-2025-51 through MFSA-2025-55) to correlate future related disclosures.
How to Mitigate CVE-2025-6425
Immediate Actions Required
- Upgrade Firefox to version 140 or later on all managed endpoints.
- Upgrade Firefox ESR to 115.25 or 128.12, matching the deployed ESR track.
- Upgrade Thunderbird to 140 or 128.12 depending on the deployed release channel.
- Apply distribution updates such as those announced in the Debian LTS Announcement June 2025 and Debian LTS Announcement July 2025.
Patch Information
Mozilla fixed the vulnerability in Firefox 140, Firefox ESR 115.25, Firefox ESR 128.12, Thunderbird 140, and Thunderbird 128.12. Detailed advisory content is available in MFSA-2025-51, MFSA-2025-52, MFSA-2025-53, MFSA-2025-54, and MFSA-2025-55.
Workarounds
- Enforce browser auto-update policies through enterprise configuration to ensure timely patching.
- Deploy content-blocking or anti-tracking extensions that limit third-party requests capable of harvesting fingerprints.
- Restrict WebExtension access where enterprise policy permits, while recognizing that WebCompat is a core Mozilla component and removal may affect site rendering.
# Verify installed Firefox version on Linux endpoints
firefox --version
# Example Debian upgrade path
sudo apt-get update && sudo apt-get install --only-upgrade firefox-esr thunderbird
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
