CVE-2025-0237

CVE Details

Release Date:

2025-01-07

Description

The WebChannel API, which is used to transport various information across processes, did not check the sending principal but rather accepted the principal being sent. This could have led to privilege escalation attacks. This vulnerability affects Firefox < 134, Firefox ESR < 128.6, Thunderbird < 134, and Thunderbird ESR < 128.6.

See more information about CVE-2025-0237 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 metrics

Base Score:	6.8
Vector String:	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Version:	3.1
Attack Vector:	Network
Attack Complexity:	High
Privileges Required:	None
User Interaction:	Required
Scope:	Unchanged
Confidentiality:	High
Integrity:	High
Availability:	None

Errata information

Platform	Errata	Release Date
Oracle Linux version 8 (firefox)	ELSA-2025-0144	2025-01-10
Oracle Linux version 9 (firefox)	ELSA-2025-0080	2025-01-10