Vulnerability Description
An attacker was able to bypass the `connect-src` directive of a Content Security Policy by manipulating subdocuments. This would have also hidden the connections from the Network tab in Devtools. This vulnerability was fixed in Firefox 140 and Thunderbird 140.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | < 140.0 |
Related Weaknesses (CWE)
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1966927Permissions Required
- https://www.mozilla.org/security/advisories/mfsa2025-51/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2025-54/
FAQ
What is CVE-2025-6427?
CVE-2025-6427 is a vulnerability with a CVSS score of 9.1 (CRITICAL). An attacker was able to bypass the `connect-src` directive of a Content Security Policy by manipulating subdocuments. This would have also hidden the connections from the Network tab in Devtools. This...
How severe is CVE-2025-6427?
CVE-2025-6427 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2025-6427?
Check the references section above for vendor advisories and patch information. Affected products include: Mozilla Firefox.