Information disclosure in the Networking: Cache component. This vulnerability affects Firefox < 143, Firefox ESR < 140.3, Thunderbird < 143, and Thunderbird < 140.3.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00018.

Exploitation none

Automatable no

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Mozilla Firefox affected
Version Status Constraints
unspecified affected
< 143
Mozilla Firefox ESR affected
Version Status Constraints
unspecified affected
< 140.3
Mozilla Thunderbird affected
Version Status Constraints
unspecified affected
< 143
Mozilla Thunderbird affected
Version Status Constraints
unspecified affected
< 140.3

Configuration 1 [-]

OR cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
Package CPE Advisory Released Date
Red Hat Enterprise Linux 10
firefox-0:140.3.0-1.el10_0 cpe:/o:redhat:enterprise_linux:10.0 RHSA-2025:16109 2025-09-17T00:00:00Z
Red Hat Enterprise Linux 9
firefox-0:140.3.0-1.el9_6 cpe:/a:redhat:enterprise_linux:9 RHSA-2025:16108 2025-09-17T00:00:00Z
Vendor Product Confidence Versions
Mozilla Firefox — —
Mozilla Firefox Esr — —
Mozilla Thunderbird — —

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Subscriptions

Vendors Products
Mozilla Subscribe
Firefox Subscribe
Firefox Esr Subscribe
Thunderbird Subscribe
Redhat Subscribe
Enterprise Linux Subscribe

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4305-1 firefox-esr security update
Debian DLA Debian DLA DLA-4311-1 thunderbird security update
Debian DSA Debian DSA DSA-6003-1 firefox-esr security update
Debian DSA Debian DSA DSA-6011-1 thunderbird security update
EUVD EUVD EUVD-2025-29558 This vulnerability affects Firefox < 143, Firefox ESR < 140.3, Thunderbird < 143, and Thunderbird < 140.3.
Ubuntu USN Ubuntu USN USN-7991-1 Thunderbird vulnerabilities
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://bugzilla.mozilla.org/show_bug.cgi?id=1981502 cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2025/09/msg00020.html cve-icon
https://lists.debian.org/debian-lts-announce/2025/09/msg00026.html cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-10536 cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-10536 cve-icon
https://www.mozilla.org/security/advisories/mfsa2025-73/ cve-icon cve-icon
https://www.mozilla.org/security/advisories/mfsa2025-75/ cve-icon cve-icon
https://www.mozilla.org/security/advisories/mfsa2025-75/#CVE-2025-10536 cve-icon
https://www.mozilla.org/security/advisories/mfsa2025-77/ cve-icon cve-icon
https://www.mozilla.org/security/advisories/mfsa2025-78/ cve-icon cve-icon
https://www.mozilla.org/security/advisories/mfsa2025-78/#CVE-2025-10536 cve-icon
History

Mon, 03 Nov 2025 19:30:00 +0000

Type Values Removed Values Added
References

Thu, 30 Oct 2025 16:30:00 +0000

Type Values Removed Values Added
Description This vulnerability affects Firefox < 143, Firefox ESR < 140.3, Thunderbird < 143, and Thunderbird < 140.3. Information disclosure in the Networking: Cache component. This vulnerability affects Firefox < 143, Firefox ESR < 140.3, Thunderbird < 143, and Thunderbird < 140.3.
Title firefox: thunderbird: Information disclosure in the Networking: Cache component Information disclosure in the Networking: Cache component

Mon, 22 Sep 2025 18:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 cvssV3_1

{'score': 6.2, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 22 Sep 2025 16:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*

Thu, 18 Sep 2025 00:15:00 +0000

Type Values Removed Values Added
Title firefox: thunderbird: Information disclosure in the Networking: Cache component
First Time appeared Redhat
Redhat enterprise Linux
CPEs cpe:/a:redhat:enterprise_linux:9
cpe:/o:redhat:enterprise_linux:10.0
Vendors & Products Redhat
Redhat enterprise Linux
References
Metrics threat_severity

None

 threat_severity

Low

Wed, 17 Sep 2025 11:00:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Mozilla firefox Esr
Mozilla thunderbird
Vendors & Products Mozilla
Mozilla firefox
Mozilla firefox Esr
Mozilla thunderbird

Tue, 16 Sep 2025 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 16 Sep 2025 15:00:00 +0000

Type Values Removed Values Added
Description This vulnerability affects Firefox < 143 and Firefox ESR < 140.3. This vulnerability affects Firefox < 143, Firefox ESR < 140.3, Thunderbird < 143, and Thunderbird < 140.3.
Weaknesses CWE-200
References
Metrics cvssV3_1

{'score': 8.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Tue, 16 Sep 2025 12:45:00 +0000

Type Values Removed Values Added
Description This vulnerability affects Firefox < 143 and Firefox ESR < 140.3.
References
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2025-11-03T18:08:36.559Z

Reserved: 2025-09-16T06:48:50.429Z

Link: CVE-2025-10536

cve-icon Vulnrichment

Updated: 2025-11-03T18:08:36.559Z

cve-icon NVD

Status : Modified

Published: 2025-09-16T13:15:48.950

Modified: 2025-11-03T19:15:45.620

Link: CVE-2025-10536

cve-icon Redhat

Severity : Low

Publid Date: 2025-09-16T12:26:36Z

Links: CVE-2025-10536 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2025-09-17T10:04:54Z

Weaknesses