An attacker was able to bypass the `connect-src` directive of a Content Security Policy by manipulating subdocuments. This would have also hidden the connections from the Network tab in Devtools. This vulnerability affects Firefox < 140 and Thunderbird < 140.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the a55d2120-58cf-11f0-b4ad-b42e991fc52e advisory.

    security@mozilla.org reports:
    An attacker was able to bypass the `connect-src`               directive of a Content Security Policy by manipulating               subdocuments.  This would have also hidden the connections               from the Network tab in Devtools.
    When Multi-Account Containers was enabled, DNS requests             could have bypassed a SOCKS proxy when the domain name was             invalid or the SOCKS proxy was not responding.
    If a user visited a webpage with an invalid TLS             certificate, and granted an exception, the webpage was able to             provide a WebAuthn challenge that the user would be prompted             to complete.  This is in violation of the WebAuthN spec which             requires a secure transport established without             errors.
    The exception page for the HTTPS-Only feature, displayed             when a website is opened via HTTP, lacked an anti-clickjacking             delay, potentially allowing an attacker to trick a user into             granting an exception and loading a webpage over HTTP.
    If a user saved a response from the Network tab in Devtools             using the Save As context menu option, that file may not have             been saved with the `.download` file extension.
            This could have led to the user inadvertently running a             malicious executable.
    Memory safety bugs present in Firefox 139 and Thunderbird             139. Some of these bugs showed evidence of memory corruption             and we presume that with enough effort some of these could             have been exploited to run arbitrary code.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote Windows host is prior to 140.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-54 advisory.

  - If a user visited a webpage with an invalid TLS certificate, and granted an exception, the webpage was     able to provide a WebAuthn challenge that the user would be prompted to complete.  This is in violation of     the WebAuthN spec which requires a secure transport established without errors. (CVE-2025-6433)

  - A use-after-free in FontFaceSet resulted in a potentially exploitable crash. (CVE-2025-6424)

  - An attacker who enumerated resources from the WebCompat extension could have obtained a persistent UUID     that identified the browser, and persisted between containers and normal/private browsing mode, but not     profiles. (CVE-2025-6425)

  - The executable file warning did not warn users before opening files with the <code>terminal</code>     extension.  This bug only affects Thunderbird for macOS. Other versions of Thunderbird are unaffected.
    (CVE-2025-6426)

  - An attacker was able to bypass the <code>connect-src</code> directive of a Content Security Policy by     manipulating subdocuments. This would have also hidden the connections from the Network tab in Devtools.
    (CVE-2025-6427)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 140.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-54 advisory.

  - If a user visited a webpage with an invalid TLS certificate, and granted an exception, the webpage was     able to provide a WebAuthn challenge that the user would be prompted to complete.  This is in violation of     the WebAuthN spec which requires a secure transport established without errors. (CVE-2025-6433)

  - A use-after-free in FontFaceSet resulted in a potentially exploitable crash. (CVE-2025-6424)

  - An attacker who enumerated resources from the WebCompat extension could have obtained a persistent UUID     that identified the browser, and persisted between containers and normal/private browsing mode, but not     profiles. (CVE-2025-6425)

  - The executable file warning did not warn users before opening files with the <code>terminal</code>     extension.  This bug only affects Thunderbird for macOS. Other versions of Thunderbird are unaffected.
    (CVE-2025-6426)

  - An attacker was able to bypass the <code>connect-src</code> directive of a Content Security Policy by     manipulating subdocuments. This would have also hidden the connections from the Network tab in Devtools.
    (CVE-2025-6427)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-1605ec3e86 advisory.

    - Updated to latest upstream (140.0)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-6bffc34b8d advisory.

    - Updated to latest upstream (140.0)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of mozilla-firefox installed on the remote host is prior to 140.0esr. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2025-175-02 advisory.

    New mozilla-firefox packages are available for Slackware 15.0 and -current to fix security issues.

Tenable has extracted the preceding description block directly from the mozilla-firefox security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote Windows host is prior to 140.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-51 advisory.

  - Memory safety bugs present in Firefox 139 and Thunderbird 139. Some of these bugs showed evidence of     memory corruption and we presume that with enough effort some of these could have been exploited to run     arbitrary code. (CVE-2025-6436)

  - A use-after-free in FontFaceSet resulted in a potentially exploitable crash. (CVE-2025-6424)

  - An attacker who enumerated resources from the WebCompat extension could have obtained a persistent UUID     that identified the browser, and persisted between containers and normal/private browsing mode, but not     profiles. (CVE-2025-6425)

  - The executable file warning did not warn users before opening files with the <code>terminal</code>     extension.  This bug only affects Firefox for macOS. Other versions of Firefox are unaffected.
    (CVE-2025-6426)

  - An attacker was able to bypass the <code>connect-src</code> directive of a Content Security Policy by     manipulating subdocuments. This would have also hidden the connections from the Network tab in Devtools.
    (CVE-2025-6427)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 140.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-51 advisory.

  - Memory safety bugs present in Firefox 139 and Thunderbird 139. Some of these bugs showed evidence of     memory corruption and we presume that with enough effort some of these could have been exploited to run     arbitrary code. (CVE-2025-6436)

  - A use-after-free in FontFaceSet resulted in a potentially exploitable crash. (CVE-2025-6424)

  - An attacker who enumerated resources from the WebCompat extension could have obtained a persistent UUID     that identified the browser, and persisted between containers and normal/private browsing mode, but not     profiles. (CVE-2025-6425)

  - The executable file warning did not warn users before opening files with the <code>terminal</code>     extension.  This bug only affects Firefox for macOS. Other versions of Firefox are unaffected.
    (CVE-2025-6426)

  - An attacker was able to bypass the <code>connect-src</code> directive of a Content Security Policy by     manipulating subdocuments. This would have also hidden the connections from the Network tab in Devtools.
    (CVE-2025-6427)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
241425	FreeBSD : firefox -- multiple vulnerabilities (a55d2120-58cf-11f0-b4ad-b42e991fc52e)	Nessus	FreeBSD Local Security Checks	critical
241211	Mozilla Thunderbird < 140.0	Nessus	Windows	critical
241210	Mozilla Thunderbird < 140.0	Nessus	MacOS X Local Security Checks	critical
240629	Fedora 41 : firefox (2025-1605ec3e86)	Nessus	Fedora Local Security Checks	critical
240515	Fedora 42 : firefox (2025-6bffc34b8d)	Nessus	Fedora Local Security Checks	high
240489	Slackware Linux 15.0 / current mozilla-firefox Multiple Vulnerabilities (SSA:2025-175-02)	Nessus	Slackware Local Security Checks	high
240334	Mozilla Firefox < 140.0	Nessus	Windows	critical
240333	Mozilla Firefox < 140.0	Nessus	MacOS X Local Security Checks	critical

Detections

Analytics

CVE-2025-6427

critical

Tenable Plugins

critical

critical

critical

critical

high

high

critical

critical