Vulnerability Description
Firefox could have incorrectly parsed a URL and rewritten it to the youtube.com domain when parsing the URL specified in an `embed` tag. This could have bypassed website security checks that restricted which domains users were allowed to embed. This vulnerability was fixed in Firefox 140, Firefox ESR 128.12, Thunderbird 140, and Thunderbird 128.12.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | < 128.12.0 |
Related Weaknesses (CWE)
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1970658Permissions Required
- https://www.mozilla.org/security/advisories/mfsa2025-51/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2025-53/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2025-54/
- https://www.mozilla.org/security/advisories/mfsa2025-55/
- https://lists.debian.org/debian-lts-announce/2025/06/msg00029.html
- https://lists.debian.org/debian-lts-announce/2025/07/msg00002.html
FAQ
What is CVE-2025-6429?
CVE-2025-6429 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Firefox could have incorrectly parsed a URL and rewritten it to the youtube.com domain when parsing the URL specified in an `embed` tag. This could have bypassed website security checks that restrict...
How severe is CVE-2025-6429?
CVE-2025-6429 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-6429?
Check the references section above for vendor advisories and patch information. Affected products include: Mozilla Firefox.