CVE-2025-6429

Firefox could incorrectly parse a URL in an embed tag and rewrite it so that the resulting domain becomes youtube.com. This misparsing allowed a malicious web page to bypass site‑wide restrictions that limit which domains may be embedded, potentially exposing users to untrusted content. The flaw combines string manipulation failure (CWE‑116) with improper handling of embedded elements (CWE‑706). The impact is the unintended loading of third‑party content, which can compromise the integrity of the browsing experience, although it does not directly lead to code execution.

Versions of Mozilla Firefox before 140 (or the ESR 128.12 release) and versions of Mozilla Thunderbird before 140 (or the ESR 128.12 release) are susceptible. The CVE list includes Common Platform Enumeration entries that reference Red Hat Enterprise Linux families — 8, 9, and 10 (including rhel_aus, rhel_e4s, rhel_eus, and rhel_tus variants). No other operating systems are explicitly listed in the CVE data, so the impact is confined to platforms where these browsers are deployed according to the provided CPEs.

The CVSS score of 6.5 indicates a medium‑to‑high risk, whereas the EPSS score of less than 1% suggests exploitation is considered unlikely at present. The vulnerability is not listed in CISA’s KEV catalog, indicating no widespread exploitation has been observed. Based on the description, the likely attack vector is a crafted web page that includes an embed tag with a URL designed to trigger the misparse; this inference assumes that attackers can control the content served to the victim’s browser. No privileged interaction or remote code execution is required. Exploitation is therefore limited to deceptive manipulation of the browsing context within the victim’s browser.