CVE-2025-6435

Summary

If a user saved a response from the Network tab in Devtools using the Save As context menu option, that file may not have been saved with the .download file extension. This could have led to the user inadvertently running a malicious executable. This vulnerability was fixed in Firefox 140 and Thunderbird 140.

Affected Software

Weaknesses

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: total

References

• https://bugzilla.mozilla.org/show_bug.cgi?id=1950056
• https://bugzilla.mozilla.org/show_bug.cgi?id=1961777
• https://www.mozilla.org/security/advisories/mfsa2025-51/
• https://www.mozilla.org/security/advisories/mfsa2025-54/

• ←Previous
• Next→