Detections
Analytics
CVE-2025-6434
medium
Description
The exception page for the HTTPS-Only feature, displayed when a website is opened via HTTP, lacked an anti-clickjacking delay, potentially allowing an attacker to trick a user into granting an exception and loading a webpage over HTTP. This vulnerability affects Firefox < 140 and Thunderbird < 140.
References
https://www.mozilla.org/security/advisories/mfsa2025-54/