CVE-2025-0237

WebChannel APIs susceptible to confused deputy attack

View on CVE.org
Published Jan 7, 2025 CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Description
The WebChannel API, which is used to transport various information across processes, did not check the sending principal but rather accepted the principal being sent. This could have led to privilege escalation attacks. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Thunderbird 134, and Thunderbird 128.6.

Analysis

AI-generated

Technical impact

The vulnerability stems from the WebChannel API not validating the sending principal before accepting it, allowing a process to impersonate another and gain elevated privileges. This flaw classifies as a confused‑deputy attack and is mapped to CWE‑441 and CWE‑863. An attacker could exploit the flaw to broaden the access scope of a less privileged process, potentially compromising confidential data or enabling further attacks.

Affected Systems

Mozilla Firefox, including ESR releases, and Mozilla Thunderbird are affected when running versions prior to Firefox 134 / ESR 128.6 and Thunderbird 134 / ESR 128.6. The issue appears in installations on various operating systems, as indicated by the Red Hat Enterprise Linux CPE entries, but the fix applies to all supported platforms.

Risk and Exploitability

The CVSS score of 5.4 suggests moderate severity while the EPSS score of < 1 % reflects a low likelihood of exploitation at present. The vulnerability is not currently listed in the CISA KEV catalog. Exploitation would involve sending malicious messages through the WebChannel API to a target process, a scenario that typically requires local user interaction or an existing compromise of the sending process.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Mozilla Firefox to version 134 or newer, and for ESR users, ensure ESR 128.6 or later is installed.
  • Update Mozilla Thunderbird to version 134 or newer, and for ESR users, ensure ESR 128.6 or later is installed.
  • If updates cannot be applied immediately, consider disabling or restricting the WebChannel API or applying sandboxing measures to isolate the affected processes, and monitor for anomalous inter‑process activity.

Generated by OpenCVE AI on April 20, 2026 at 18:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-4011-1 firefox-esr security update
Debian DLA Debian DLA DLA-4012-1 thunderbird security update
Debian DSA Debian DSA DSA-5839-1 firefox-esr security update
Debian DSA Debian DSA DSA-5841-1 thunderbird security update
EUVD EUVD EUVD-2025-1569 The WebChannel API, which is used to transport various information across processes, did not check the sending principal but rather accepted the principal being sent. This could have led to privilege escalation attacks. This vulnerability affects Firefox < 134, Firefox ESR < 128.6, Thunderbird < 134, and Thunderbird < 128.6.
Ubuntu USN Ubuntu USN USN-7191-1 Firefox vulnerabilities
Ubuntu USN Ubuntu USN USN-7991-1 Thunderbird vulnerabilities
History
Type Values Removed Values Added
Description The WebChannel API, which is used to transport various information across processes, did not check the sending principal but rather accepted the principal being sent. This could have led to privilege escalation attacks. This vulnerability affects Firefox < 134, Firefox ESR < 128.6, Thunderbird < 134, and Thunderbird < 128.6. The WebChannel API, which is used to transport various information across processes, did not check the sending principal but rather accepted the principal being sent. This could have led to privilege escalation attacks. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Thunderbird 134, and Thunderbird 128.6.
Title firefox: thunderbird: WebChannel APIs susceptible to confused deputy attack WebChannel APIs susceptible to confused deputy attack
Type Values Removed Values Added
References
Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Mozilla thunderbird
CPEs cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
Vendors & Products Mozilla
Mozilla firefox
Mozilla thunderbird
Type Values Removed Values Added
Title firefox: WebChannel APIs susceptible to confused deputy attack firefox: thunderbird: WebChannel APIs susceptible to confused deputy attack
CPEs cpe:/a:redhat:rhel_aus:8.2
cpe:/a:redhat:rhel_aus:8.6
cpe:/a:redhat:rhel_e4s:8.6
cpe:/a:redhat:rhel_e4s:9.0
cpe:/a:redhat:rhel_eus:8.8
cpe:/a:redhat:rhel_eus:9.4
cpe:/a:redhat:rhel_tus:8.6
Type Values Removed Values Added
Description The WebChannel API, which is used to transport various information across processes, did not check the sending principal but rather accepted the principal being sent. This could have led to privilege escalation attacks. This vulnerability affects Firefox < 134, Firefox ESR < 128.6, Thunderbird < 134, and Thunderbird ESR < 128.6. The WebChannel API, which is used to transport various information across processes, did not check the sending principal but rather accepted the principal being sent. This could have led to privilege escalation attacks. This vulnerability affects Firefox < 134, Firefox ESR < 128.6, Thunderbird < 134, and Thunderbird < 128.6.
Type Values Removed Values Added
Title firefox: WebChannel APIs susceptible to confused deputy attack
First Time appeared Redhat
Redhat enterprise Linux
Redhat rhel Aus
Redhat rhel E4s
Redhat rhel Els
Redhat rhel Eus
Redhat rhel Tus
Weaknesses CWE-441
CPEs cpe:/a:redhat:enterprise_linux:8
cpe:/a:redhat:enterprise_linux:9
cpe:/a:redhat:rhel_aus:8.4
cpe:/a:redhat:rhel_e4s:8.4
cpe:/a:redhat:rhel_eus:9.2
cpe:/a:redhat:rhel_tus:8.4
cpe:/o:redhat:rhel_els:7
Vendors & Products Redhat
Redhat enterprise Linux
Redhat rhel Aus
Redhat rhel E4s
Redhat rhel Els
Redhat rhel Eus
Redhat rhel Tus
References
Metrics threat_severity

None

 threat_severity

Moderate
Type Values Removed Values Added
Description The WebChannel API, which is used to transport various information across processes, did not check the sending principal but rather accepted the principal being sent. This could have led to privilege escalation attacks. This vulnerability affects Firefox < 134 and Firefox ESR < 128.6. The WebChannel API, which is used to transport various information across processes, did not check the sending principal but rather accepted the principal being sent. This could have led to privilege escalation attacks. This vulnerability affects Firefox < 134, Firefox ESR < 128.6, Thunderbird < 134, and Thunderbird ESR < 128.6.
References
Type Values Removed Values Added
Weaknesses CWE-863
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description The WebChannel API, which is used to transport various information across processes, did not check the sending principal but rather accepted the principal being sent. This could have led to privilege escalation attacks. This vulnerability affects Firefox < 134 and Firefox ESR < 128.6.
References
Earlier changes (4)
Weaknesses
  • CWE-441

    Unintended Proxy or Intermediary ('Confused Deputy')

  • CWE-863

    Incorrect Authorization

Sources

Status
PUBLISHED
Assigner
mozilla
Published
Updated
Apr 13, 2026, 2:29 PM
Reserved
Jan 6, 2025, 2:48 PM

View source JSON

Updated
Nov 3, 2025, 10:33 PM

JSON

Status
Modified
Published
Jan 7, 2025, 4:15 PM
Modified
Oct 5, 2026, 3:10 PM

View source JSON

Severity
Moderate
Public date
Jan 7, 2025, 4:07 PM

View source Bugzilla JSON

Updated
Apr 20, 2026, 6:45 PM

JSON