Medium severity6.5NVD Advisory· Published Jun 24, 2025· Updated Apr 13, 2026

CVE-2025-6429

Description

Firefox could have incorrectly parsed a URL and rewritten it to the youtube.com domain when parsing the URL specified in an embed tag. This could have bypassed website security checks that restricted which domains users were allowed to embed. This vulnerability was fixed in Firefox 140, Firefox ESR 128.12, Thunderbird 140, and Thunderbird 128.12.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Mozilla Corporation/Firefox4 versions
cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*+ 3 more
- cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*range: <140.0
- cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*range: <128.12.0
- (no CPE)range: <128.12
- (no CPE)range: <140
Mozilla Corporation/Thunderbirdllm-fuzzy2 versions
<128.12+ 1 more
- (no CPE)range: <128.12
- (no CPE)range: <140
osv-coords74 versions
pkg:rpm/almalinux/firefox pkg:rpm/almalinux/firefox-x11 pkg:rpm/opensuse/firefox-esr&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/MozillaFirefox-branding-SLE&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/MozillaFirefox&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/MozillaFirefox&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/MozillaThunderbird&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/MozillaThunderbird&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/mozjs128&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/mozjs128&distro=openSUSE%20Tumbleweed pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Enterprise%20Storage%207.1 pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSS pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP6 pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP7 pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5-LTSS pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSS pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3 pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4 pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5 pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Server%20LTSS%20Extended%20Security%2012%20SP5 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Enterprise%20Storage%207.1 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSS pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP6 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP7 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5-LTSS pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSS pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20LTSS%20Extended%20Security%2012%20SP5 pkg:rpm/suse/MozillaThunderbird&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP6 pkg:rpm/suse/MozillaThunderbird&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7 pkg:rpm/suse/MozillaThunderbird&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2015%20SP6 pkg:rpm/suse/MozillaThunderbird&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2015%20SP7 pkg:rpm/suse/mozjs128&distro=SUSE%20Linux%20Enterprise%20Server%2016.0 pkg:rpm/suse/mozjs128&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0 pkg:rpm/suse/pipewire&distro=SUSE%20Enterprise%20Storage%207.1 pkg:rpm/suse/pipewire&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSS pkg:rpm/suse/pipewire&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS pkg:rpm/suse/pipewire&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS pkg:rpm/suse/pipewire&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS pkg:rpm/suse/pipewire&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS pkg:rpm/suse/pipewire&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP6 pkg:rpm/suse/pipewire&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7 pkg:rpm/suse/pipewire&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSS pkg:rpm/suse/pipewire&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS pkg:rpm/suse/pipewire&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS pkg:rpm/suse/pipewire&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3 pkg:rpm/suse/pipewire&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4 pkg:rpm/suse/pipewire&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5 pkg:rpm/suse/xdg-desktop-portal&distro=SUSE%20Enterprise%20Storage%207.1 pkg:rpm/suse/xdg-desktop-portal&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSS pkg:rpm/suse/xdg-desktop-portal&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS pkg:rpm/suse/xdg-desktop-portal&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS pkg:rpm/suse/xdg-desktop-portal&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS pkg:rpm/suse/xdg-desktop-portal&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS pkg:rpm/suse/xdg-desktop-portal&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSS pkg:rpm/suse/xdg-desktop-portal&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS pkg:rpm/suse/xdg-desktop-portal&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS pkg:rpm/suse/xdg-desktop-portal&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3 pkg:rpm/suse/xdg-desktop-portal&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4 pkg:rpm/suse/xdg-desktop-portal&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5
< 128.12.0-1.el9_6.alma.1+ 73 more
- (no CPE)range: < 128.12.0-1.el9_6.alma.1
- (no CPE)range: < 128.12.0-1.el9_6.alma.1
- (no CPE)range: < 128.12.0-1.1
- (no CPE)range: < 140-150200.9.21.1
- (no CPE)range: < 128.12.0-150200.152.188.1
- (no CPE)range: < 140.0.2-1.1
- (no CPE)range: < 128.12.0-150200.8.227.2
- (no CPE)range: < 128.12.0-1.1
- (no CPE)range: < 128.14.0-160000.1.1
- (no CPE)range: < 128.12.0-1.1
- (no CPE)range: < 140-150200.9.21.1
- (no CPE)range: < 140-150200.9.21.1
- (no CPE)range: < 140-150200.9.21.1
- (no CPE)range: < 140-150200.9.21.1
- (no CPE)range: < 140-150200.9.21.1
- (no CPE)range: < 140-150200.9.21.1
- (no CPE)range: < 140-150200.9.21.1
- (no CPE)range: < 140-150200.9.21.1
- (no CPE)range: < 140-35.19.5
- (no CPE)range: < 140-150200.9.21.1
- (no CPE)range: < 140-150200.9.21.1
- (no CPE)range: < 140-150200.9.21.1
- (no CPE)range: < 140-150200.9.21.1
- (no CPE)range: < 140-150200.9.21.1
- (no CPE)range: < 140-150200.9.21.1
- (no CPE)range: < 140-35.19.5
- (no CPE)range: < 128.12.0-150200.152.188.1
- (no CPE)range: < 128.12.0-150200.152.188.1
- (no CPE)range: < 128.12.0-150200.152.188.1
- (no CPE)range: < 128.12.0-150200.152.188.1
- (no CPE)range: < 128.12.0-150200.152.188.1
- (no CPE)range: < 128.12.0-150200.152.188.1
- (no CPE)range: < 128.12.0-150200.152.188.1
- (no CPE)range: < 128.12.0-150200.152.188.1
- (no CPE)range: < 128.12.0-112.265.1
- (no CPE)range: < 128.12.0-150200.152.188.1
- (no CPE)range: < 128.12.0-150200.152.188.1
- (no CPE)range: < 128.12.0-150200.152.188.1
- (no CPE)range: < 128.12.0-150200.152.188.1
- (no CPE)range: < 128.12.0-150200.152.188.1
- (no CPE)range: < 128.12.0-150200.152.188.1
- (no CPE)range: < 128.12.0-112.265.1
- (no CPE)range: < 128.12.0-150200.8.227.2
- (no CPE)range: < 128.12.0-150200.8.227.2
- (no CPE)range: < 128.12.0-150200.8.227.2
- (no CPE)range: < 128.12.0-150200.8.227.2
- (no CPE)range: < 128.14.0-160000.1.1
- (no CPE)range: < 128.14.0-160000.1.1
- (no CPE)range: < 0.3.24-150300.4.8.1
- (no CPE)range: < 0.3.24-150300.4.8.1
- (no CPE)range: < 0.3.49-150400.3.7.1
- (no CPE)range: < 0.3.49-150400.3.7.1
- (no CPE)range: < 0.3.64-150500.3.7.2
- (no CPE)range: < 0.3.64-150500.3.7.2
- (no CPE)range: < 0.3.6-150200.3.11.1
- (no CPE)range: < 0.3.6-150200.3.11.1
- (no CPE)range: < 0.3.24-150300.4.8.1
- (no CPE)range: < 0.3.49-150400.3.7.1
- (no CPE)range: < 0.3.64-150500.3.7.2
- (no CPE)range: < 0.3.24-150300.4.8.1
- (no CPE)range: < 0.3.49-150400.3.7.1
- (no CPE)range: < 0.3.64-150500.3.7.2
- (no CPE)range: < 1.8.0-150200.5.8.1
- (no CPE)range: < 1.8.0-150200.5.8.1
- (no CPE)range: < 1.10.1-150400.3.8.1
- (no CPE)range: < 1.10.1-150400.3.8.1
- (no CPE)range: < 1.16.0-150500.3.8.1
- (no CPE)range: < 1.16.0-150500.3.8.1
- (no CPE)range: < 1.8.0-150200.5.8.1
- (no CPE)range: < 1.10.1-150400.3.8.1
- (no CPE)range: < 1.16.0-150500.3.8.1
- (no CPE)range: < 1.8.0-150200.5.8.1
- (no CPE)range: < 1.10.1-150400.3.8.1
- (no CPE)range: < 1.16.0-150500.3.8.1

Patches

Vulnerability mechanics

References

www.mozilla.org/security/advisories/mfsa2025-51/nvdVendor Advisory
www.mozilla.org/security/advisories/mfsa2025-53/nvdVendor Advisory
bugzilla.mozilla.org/show_bug.cginvdPermissions Required
lists.debian.org/debian-lts-announce/2025/06/msg00029.htmlnvd
lists.debian.org/debian-lts-announce/2025/07/msg00002.htmlnvd
www.mozilla.org/security/advisories/mfsa2025-54/nvd
www.mozilla.org/security/advisories/mfsa2025-55/nvd

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000