CVE-2025-6434: Mozilla Firefox CSRF Vulnerability

CVE-2025-6434 Overview

CVE-2025-6434 affects the HTTPS-Only mode feature in Mozilla Firefox and Thunderbird. The exception page shown when a user navigates to a site over HTTP lacked an anti-clickjacking delay before accepting user input. An attacker controlling a malicious page can time UI elements to trick the user into granting a permanent HTTP exception, downgrading the connection from HTTPS to plaintext HTTP. Mozilla fixed the issue in Firefox 140 and Thunderbird 140. The weakness is classified as [CWE-1021] Improper Restriction of Rendered UI Layers or Frames.

Critical Impact
Successful exploitation downgrades a protected HTTPS session to HTTP, exposing subsequent traffic to interception and modification by a network-positioned attacker.

Affected Products

Mozilla Firefox versions prior to 140
Mozilla Thunderbird versions prior to 140
Firefox ESR builds preceding the corresponding 140-based release

Discovery Timeline

2025-06-24 - CVE-2025-6434 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-6434

Vulnerability Analysis

Firefox's HTTPS-Only mode blocks plaintext HTTP navigation and presents an interstitial exception page when a user requests an HTTP resource. This page includes a button that grants a temporary or permanent exception, allowing the browser to load the site over HTTP. Security-sensitive prompts in browsers typically enforce an input delay so users cannot be tricked into activating them through timing-based UI manipulation. The vulnerable exception page did not implement this delay.

An attacker who lures a victim to a controlled origin can render overlays, animations, or transient UI that align a click with the exception approval button at the moment the interstitial appears. The user believes they are interacting with unrelated content while actually authorizing an HTTP downgrade for the target origin.

Root Cause

The root cause is a missing anti-clickjacking safeguard on a security decision UI. The exception page accepted activation events immediately upon rendering rather than requiring a minimum interaction delay to ensure the user consciously acknowledged the prompt.

Attack Vector

Exploitation requires user interaction and network reachability to a page under attacker control. The attacker crafts a page that opens or navigates to an HTTP resource, triggering the HTTPS-Only interstitial. Layered UI or precisely timed events cause the victim's click to land on the exception button. Once the exception is granted, subsequent visits load the target origin over HTTP, enabling downstream man-in-the-middle attacks on that origin.

No verified proof-of-concept code is publicly available. Refer to the Mozilla Bug Report #1955182 for the technical discussion.

Detection Methods for CVE-2025-6434

Indicators of Compromise

Unexpected entries in the HTTPS-Only exception list within Firefox site settings for domains a user did not intentionally allow.
Enterprise proxy or DNS logs showing HTTP requests to origins previously accessed exclusively over HTTPS.
Endpoint telemetry showing Firefox versions below 140 or Thunderbird versions below 140 in the environment.

Detection Strategies

Inventory browser versions across managed endpoints and flag Firefox and Thunderbird installations below build 140.
Parse the Firefox permissions.sqlite profile database for https-only-load-insecure entries that indicate granted HTTP exceptions.
Correlate outbound HTTP traffic from user workstations against a baseline of HTTPS-only destinations to surface anomalous downgrades.

Monitoring Recommendations

Alert on HTTP connections to domains normally reached via HTTPS from user endpoints.
Track deployment progress of Firefox 140 and Thunderbird 140 through patch management reporting.
Review browser configuration policies to confirm HTTPS-Only mode remains enabled after updates.

How to Mitigate CVE-2025-6434

Immediate Actions Required

Upgrade Firefox to version 140 or later and Thunderbird to version 140 or later on all endpoints.
Audit and clear pre-existing HTTPS-Only exceptions in user profiles that may have been granted before patching.
Enforce automatic browser updates through enterprise policy to prevent regression to vulnerable builds.

Patch Information

Mozilla addressed the issue in Firefox 140 and Thunderbird 140. Full remediation details are available in the Mozilla Security Advisory MFSA-2025-51 and Mozilla Security Advisory MFSA-2025-54.

Workarounds

Deploy the Firefox enterprise policy DisableSecurityBypass or lock the HTTPS-Only exception UI where supported.
Instruct users not to grant HTTP exceptions from the HTTPS-Only interstitial until patching is complete.
Route browser traffic through a proxy that blocks plaintext HTTP to sensitive destinations as a compensating control.

bash

# Configuration example: enforce HTTPS-Only mode via Firefox policies.json
{
  "policies": {
    "Preferences": {
      "dom.security.https_only_mode": {
        "Value": true,
        "Status": "locked"
      },
      "dom.security.https_only_mode_ever_enabled": {
        "Value": true,
        "Status": "locked"
      }
    },
    "DisableAppUpdate": false
  }
}