Skip to content
OpenAdvisories
Medium · 6.5 CVE-2025-4088 EUVD-2025-12651GHSA-vvxh-6r52-hj35

Cross-site request forgery via storage access API redirects

Published Apr 29, 2025 · Updated Apr 13, 2026 · Assigned by mozilla

Vendor: Mozilla Product: Firefox Product: Thunderbird Package: firefox Package: mozjs102 Package: mozjs115 Package: mozjs38 Package: mozjs52 Package: mozjs68 Package: mozjs78 Package: mozjs91 Package: thunderbird Category: Browsers Ecosystem: Ubuntu Ecosystem: Wolfi

Description

A security vulnerability in Thunderbird allowed malicious sites to use redirects to send credentialed requests to arbitrary endpoints on any site that had invoked the Storage Access API. This enabled potential Cross-Site Request Forgery attacks across origins. This vulnerability was fixed in Firefox 138 and Thunderbird 138.

Affected products

VendorProductAffectedFixed
Mozilla Firefox — 138
Mozilla Thunderbird — 138

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS mozjs102 +1 No fix yet —
Ubuntu 22.04 LTS mozjs78 +2 No fix yet —
Ubuntu 22.04 LTS thunderbird 1:140.7.1+build1-0ubuntu0.22.04.1 —
Ubuntu 20.04 LTS mozjs52 +1 No fix yet —
Ubuntu 18.04 LTS mozjs38 +1 No fix yet —

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed MozillaFirefox 138.0-1.1 openSUSE-SU-2025:15045-1
openSUSE Tumbleweed firefox-esr 153.0-1.1 openSUSE-SU-2026:11373-1

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling firefox 138-r0 —

Advisories 5

References