An attacker with control over a content process could potentially leverage the privileged UITour actor to leak sensitive information or escalate privileges. This vulnerability was fixed in Firefox 138 and Thunderbird 138.

The remote Ubuntu 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7991-1 advisory.

    Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially     crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of     service, obtain sensitive information, bypass security restrictions, cross-site tracing, or execute     arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An attacker with control over a content process could potentially leverage the privileged UITour actor to     leak sensitive information or escalate privileges. This vulnerability was fixed in Firefox 138 and     Thunderbird 138. (CVE-2025-4085)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 9fa8c4a2-2e85-11f0-a989-b42e991fc52e advisory.

    security@mozilla.org reports:
    An attacker with control over a content process could               potentially leverage the privileged UITour actor to leak               sensitive information or escalate privileges.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-33d579ecb1 advisory.

    - Update to latest upstream (138.0)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 138.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-31 advisory.

  - Memory safety bugs present in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9. Some     of these bugs showed evidence of memory corruption and we presume that with enough effort some of these     could have been exploited to run arbitrary code. (CVE-2025-4091)

  - A process isolation vulnerability in Thunderbird stemmed from improper handling of javascript: URIs, which     could allow content to execute in the top-level document's process instead of the intended frame,     potentially enabling a sandbox escape. (CVE-2025-4083)

  - Thunderbird's update mechanism allowed a medium-integrity user process to interfere with the SYSTEM-level     updater by manipulating the file-locking behavior. By injecting code into the user-privileged process, an     attacker could bypass intended access controls, allowing SYSTEM-level file operations on paths controlled     by a non-privileged user and enabling privilege escalation. (CVE-2025-2817)

  - Modification of specific WebGL shader attributes could trigger an out-of-bounds read, which, when chained     with other vulnerabilities, could be used to escalate privileges. This bug only affects Thunderbird for     macOS. Other versions of Thunderbird are unaffected. (CVE-2025-4082)

  - An attacker with control over a content process could potentially leverage the privileged UITour actor to     leak sensitive information or escalate privileges. (CVE-2025-4085)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote Windows host is prior to 138.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-31 advisory.

  - Memory safety bugs present in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9. Some     of these bugs showed evidence of memory corruption and we presume that with enough effort some of these     could have been exploited to run arbitrary code. (CVE-2025-4091)

  - A process isolation vulnerability in Thunderbird stemmed from improper handling of javascript: URIs, which     could allow content to execute in the top-level document's process instead of the intended frame,     potentially enabling a sandbox escape. (CVE-2025-4083)

  - Thunderbird's update mechanism allowed a medium-integrity user process to interfere with the SYSTEM-level     updater by manipulating the file-locking behavior. By injecting code into the user-privileged process, an     attacker could bypass intended access controls, allowing SYSTEM-level file operations on paths controlled     by a non-privileged user and enabling privilege escalation. (CVE-2025-2817)

  - Modification of specific WebGL shader attributes could trigger an out-of-bounds read, which, when chained     with other vulnerabilities, could be used to escalate privileges. This bug only affects Thunderbird for     macOS. Other versions of Thunderbird are unaffected. (CVE-2025-4082)

  - An attacker with control over a content process could potentially leverage the privileged UITour actor to     leak sensitive information or escalate privileges. (CVE-2025-4085)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 138.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-28 advisory.

  - Memory safety bugs present in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9. Some     of these bugs showed evidence of memory corruption and we presume that with enough effort some of these     could have been exploited to run arbitrary code. (CVE-2025-4091)

  - A process isolation vulnerability in Firefox stemmed from improper handling of javascript: URIs, which     could allow content to execute in the top-level document's process instead of the intended frame,     potentially enabling a sandbox escape. (CVE-2025-4083)

  - Mozilla Firefox's update mechanism allowed a medium-integrity user process to interfere with the SYSTEM-     level updater by manipulating the file-locking behavior. By injecting code into the user-privileged     process, an attacker could bypass intended access controls, allowing SYSTEM-level file operations on paths     controlled by a non-privileged user and enabling privilege escalation. (CVE-2025-2817)

  - Modification of specific WebGL shader attributes could trigger an out-of-bounds read, which, when chained     with other vulnerabilities, could be used to escalate privileges. This bug only affects Firefox for macOS.
    Other versions of Firefox are unaffected. (CVE-2025-4082)

  - An attacker with control over a content process could potentially leverage the privileged UITour actor to     leak sensitive information or escalate privileges. (CVE-2025-4085)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote Windows host is prior to 138.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-28 advisory.

  - Memory safety bugs present in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9. Some     of these bugs showed evidence of memory corruption and we presume that with enough effort some of these     could have been exploited to run arbitrary code. (CVE-2025-4091)

  - A process isolation vulnerability in Firefox stemmed from improper handling of javascript: URIs, which     could allow content to execute in the top-level document's process instead of the intended frame,     potentially enabling a sandbox escape. (CVE-2025-4083)

  - Mozilla Firefox's update mechanism allowed a medium-integrity user process to interfere with the SYSTEM-     level updater by manipulating the file-locking behavior. By injecting code into the user-privileged     process, an attacker could bypass intended access controls, allowing SYSTEM-level file operations on paths     controlled by a non-privileged user and enabling privilege escalation. (CVE-2025-2817)

  - Modification of specific WebGL shader attributes could trigger an out-of-bounds read, which, when chained     with other vulnerabilities, could be used to escalate privileges. This bug only affects Firefox for macOS.
    Other versions of Firefox are unaffected. (CVE-2025-4082)

  - An attacker with control over a content process could potentially leverage the privileged UITour actor to     leak sensitive information or escalate privileges. (CVE-2025-4085)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
297659	Ubuntu 22.04 LTS : Thunderbird vulnerabilities (USN-7991-1)	Nessus	Ubuntu Local Security Checks	Local	medium
249406	Linux Distros Unpatched Vulnerability : CVE-2025-4085	Nessus	Misc.	Local	high
235693	FreeBSD : Mozilla -- Information leak (9fa8c4a2-2e85-11f0-a989-b42e991fc52e)	Nessus	FreeBSD Local Security Checks	Local	high
235469	Fedora 41 : firefox (2025-33d579ecb1)	Nessus	Fedora Local Security Checks	Local	critical
234927	Mozilla Thunderbird < 138.0	Nessus	MacOS X Local Security Checks	Local	critical
234926	Mozilla Thunderbird < 138.0	Nessus	Windows	Local	critical
234925	Mozilla Firefox < 138.0	Nessus	MacOS X Local Security Checks	Local	critical
234924	Mozilla Firefox < 138.0	Nessus	Windows	Local	critical

Detections

Analytics

CVE-2025-4085

high

Tenable Plugins

medium

high

high

critical

critical

critical

critical

critical