Detections
Analytics
CVE-2025-6427
critical
Description
An attacker was able to bypass the `connect-src` directive of a Content Security Policy by manipulating subdocuments. This would have also hidden the connections from the Network tab in Devtools. This vulnerability affects Firefox < 140 and Thunderbird < 140.
References
https://www.mozilla.org/security/advisories/mfsa2025-54/