Medium severity6.1NVD Advisory· Published Jun 24, 2025· Updated Apr 13, 2026

CVE-2025-6430

Description

When a file download is specified via the Content-Disposition header, that directive would be ignored if the file was included via a <embed> or <object> tag, potentially making a website vulnerable to a cross-site scripting attack. This vulnerability was fixed in Firefox 140, Firefox ESR 128.12, Thunderbird 140, and Thunderbird 128.12.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Mozilla Corporation/Firefox4 versions
cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*+ 3 more
- cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*range: <140.0
- cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*range: <128.12.0
- (no CPE)range: <128.12
- (no CPE)range: <140
Mozilla Corporation/Thunderbirdllm-fuzzy
Range: <140
osv-coords74 versions
pkg:rpm/almalinux/firefox pkg:rpm/almalinux/firefox-x11 pkg:rpm/opensuse/firefox-esr&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/MozillaFirefox-branding-SLE&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/MozillaFirefox&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/MozillaFirefox&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/MozillaThunderbird&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/MozillaThunderbird&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/mozjs128&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/mozjs128&distro=openSUSE%20Tumbleweed pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Enterprise%20Storage%207.1 pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSS pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP6 pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP7 pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5-LTSS pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSS pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3 pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4 pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5 pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Server%20LTSS%20Extended%20Security%2012%20SP5 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Enterprise%20Storage%207.1 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSS pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP6 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP7 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5-LTSS pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSS pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20LTSS%20Extended%20Security%2012%20SP5 pkg:rpm/suse/MozillaThunderbird&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP6 pkg:rpm/suse/MozillaThunderbird&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7 pkg:rpm/suse/MozillaThunderbird&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2015%20SP6 pkg:rpm/suse/MozillaThunderbird&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2015%20SP7 pkg:rpm/suse/mozjs128&distro=SUSE%20Linux%20Enterprise%20Server%2016.0 pkg:rpm/suse/mozjs128&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0 pkg:rpm/suse/pipewire&distro=SUSE%20Enterprise%20Storage%207.1 pkg:rpm/suse/pipewire&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSS pkg:rpm/suse/pipewire&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS pkg:rpm/suse/pipewire&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS pkg:rpm/suse/pipewire&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS pkg:rpm/suse/pipewire&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS pkg:rpm/suse/pipewire&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP6 pkg:rpm/suse/pipewire&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7 pkg:rpm/suse/pipewire&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSS pkg:rpm/suse/pipewire&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS pkg:rpm/suse/pipewire&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS pkg:rpm/suse/pipewire&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3 pkg:rpm/suse/pipewire&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4 pkg:rpm/suse/pipewire&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5 pkg:rpm/suse/xdg-desktop-portal&distro=SUSE%20Enterprise%20Storage%207.1 pkg:rpm/suse/xdg-desktop-portal&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSS pkg:rpm/suse/xdg-desktop-portal&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS pkg:rpm/suse/xdg-desktop-portal&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS pkg:rpm/suse/xdg-desktop-portal&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS pkg:rpm/suse/xdg-desktop-portal&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS pkg:rpm/suse/xdg-desktop-portal&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSS pkg:rpm/suse/xdg-desktop-portal&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS pkg:rpm/suse/xdg-desktop-portal&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS pkg:rpm/suse/xdg-desktop-portal&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3 pkg:rpm/suse/xdg-desktop-portal&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4 pkg:rpm/suse/xdg-desktop-portal&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5
< 128.12.0-1.el9_6.alma.1+ 73 more
- (no CPE)range: < 128.12.0-1.el9_6.alma.1
- (no CPE)range: < 128.12.0-1.el9_6.alma.1
- (no CPE)range: < 128.12.0-1.1
- (no CPE)range: < 140-150200.9.21.1
- (no CPE)range: < 128.12.0-150200.152.188.1
- (no CPE)range: < 140.0.2-1.1
- (no CPE)range: < 128.12.0-150200.8.227.2
- (no CPE)range: < 128.12.0-1.1
- (no CPE)range: < 128.14.0-160000.1.1
- (no CPE)range: < 128.12.0-1.1
- (no CPE)range: < 140-150200.9.21.1
- (no CPE)range: < 140-150200.9.21.1
- (no CPE)range: < 140-150200.9.21.1
- (no CPE)range: < 140-150200.9.21.1
- (no CPE)range: < 140-150200.9.21.1
- (no CPE)range: < 140-150200.9.21.1
- (no CPE)range: < 140-150200.9.21.1
- (no CPE)range: < 140-150200.9.21.1
- (no CPE)range: < 140-35.19.5
- (no CPE)range: < 140-150200.9.21.1
- (no CPE)range: < 140-150200.9.21.1
- (no CPE)range: < 140-150200.9.21.1
- (no CPE)range: < 140-150200.9.21.1
- (no CPE)range: < 140-150200.9.21.1
- (no CPE)range: < 140-150200.9.21.1
- (no CPE)range: < 140-35.19.5
- (no CPE)range: < 128.12.0-150200.152.188.1
- (no CPE)range: < 128.12.0-150200.152.188.1
- (no CPE)range: < 128.12.0-150200.152.188.1
- (no CPE)range: < 128.12.0-150200.152.188.1
- (no CPE)range: < 128.12.0-150200.152.188.1
- (no CPE)range: < 128.12.0-150200.152.188.1
- (no CPE)range: < 128.12.0-150200.152.188.1
- (no CPE)range: < 128.12.0-150200.152.188.1
- (no CPE)range: < 128.12.0-112.265.1
- (no CPE)range: < 128.12.0-150200.152.188.1
- (no CPE)range: < 128.12.0-150200.152.188.1
- (no CPE)range: < 128.12.0-150200.152.188.1
- (no CPE)range: < 128.12.0-150200.152.188.1
- (no CPE)range: < 128.12.0-150200.152.188.1
- (no CPE)range: < 128.12.0-150200.152.188.1
- (no CPE)range: < 128.12.0-112.265.1
- (no CPE)range: < 128.12.0-150200.8.227.2
- (no CPE)range: < 128.12.0-150200.8.227.2
- (no CPE)range: < 128.12.0-150200.8.227.2
- (no CPE)range: < 128.12.0-150200.8.227.2
- (no CPE)range: < 128.14.0-160000.1.1
- (no CPE)range: < 128.14.0-160000.1.1
- (no CPE)range: < 0.3.24-150300.4.8.1
- (no CPE)range: < 0.3.24-150300.4.8.1
- (no CPE)range: < 0.3.49-150400.3.7.1
- (no CPE)range: < 0.3.49-150400.3.7.1
- (no CPE)range: < 0.3.64-150500.3.7.2
- (no CPE)range: < 0.3.64-150500.3.7.2
- (no CPE)range: < 0.3.6-150200.3.11.1
- (no CPE)range: < 0.3.6-150200.3.11.1
- (no CPE)range: < 0.3.24-150300.4.8.1
- (no CPE)range: < 0.3.49-150400.3.7.1
- (no CPE)range: < 0.3.64-150500.3.7.2
- (no CPE)range: < 0.3.24-150300.4.8.1
- (no CPE)range: < 0.3.49-150400.3.7.1
- (no CPE)range: < 0.3.64-150500.3.7.2
- (no CPE)range: < 1.8.0-150200.5.8.1
- (no CPE)range: < 1.8.0-150200.5.8.1
- (no CPE)range: < 1.10.1-150400.3.8.1
- (no CPE)range: < 1.10.1-150400.3.8.1
- (no CPE)range: < 1.16.0-150500.3.8.1
- (no CPE)range: < 1.16.0-150500.3.8.1
- (no CPE)range: < 1.8.0-150200.5.8.1
- (no CPE)range: < 1.10.1-150400.3.8.1
- (no CPE)range: < 1.16.0-150500.3.8.1
- (no CPE)range: < 1.8.0-150200.5.8.1
- (no CPE)range: < 1.10.1-150400.3.8.1
- (no CPE)range: < 1.16.0-150500.3.8.1

Patches

Vulnerability mechanics

References

www.mozilla.org/security/advisories/mfsa2025-51/nvdVendor Advisory
www.mozilla.org/security/advisories/mfsa2025-53/nvdVendor Advisory
bugzilla.mozilla.org/show_bug.cginvdPermissions Required
lists.debian.org/debian-lts-announce/2025/06/msg00029.htmlnvd
lists.debian.org/debian-lts-announce/2025/07/msg00002.htmlnvd
www.mozilla.org/security/advisories/mfsa2025-54/nvd
www.mozilla.org/security/advisories/mfsa2025-55/nvd

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000