Description
In some cases search terms persisted in the URL bar even after navigating away from the search page. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1.
Published: 2025-07-22
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Potential exposure of confidential search queries
Action: Patch immediately
AI Analysis

Impact

This vulnerability allows search terms entered by a user to persist in the browser’s address bar even after the user has navigated away from the search page. Because the URL bar is visible to anyone using the same machine, the stored query can inadvertently reveal sensitive or personal information that the user intended to keep private.

Affected Systems

The flaw affects Mozilla Firefox, including the main releases and ESR line, and Mozilla Thunderbird. Versions preceding Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1 are impacted.

Risk and Exploitability

The CVSS score of 8.1 reflects a high severity. The very low EPSS score of less than 1 % indicates that exploitation is unlikely in the wild, and the vulnerability is not listed in the CISA KEV catalog. Attacks would involve a local user or anyone who can view the address bar; no network or remote access is required. The impact is limited to confidential data leakage through visible query strings rather than a compromise of system integrity or availability.

Generated by OpenCVE AI on April 20, 2026 at 16:53 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Firefox to version 141 or later, or to Firefox ESR 140.1 or newer.
  • Update Thunderbird to version 141 or later, or to Thunderbird 140.1 or newer.
  • Clear browsing history or disable address‑bar history to prevent persistence if an update cannot be applied immediately.

Generated by OpenCVE AI on April 20, 2026 at 16:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-22363 In some cases search terms persisted in the URL bar even after navigating away from the search page. This vulnerability affects Firefox < 141, Firefox ESR < 140.1, Thunderbird < 141, and Thunderbird < 140.1.
Ubuntu USN Ubuntu USN USN-7991-1 Thunderbird vulnerabilities
History

Mon, 13 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Description In some cases search terms persisted in the URL bar even after navigating away from the search page. This vulnerability affects Firefox < 141, Firefox ESR < 140.1, Thunderbird < 141, and Thunderbird < 140.1. In some cases search terms persisted in the URL bar even after navigating away from the search page. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1.

Thu, 30 Oct 2025 16:15:00 +0000

Type Values Removed Values Added
Title firefox: Search terms persisted in URL bar Search terms persisted in URL bar

Tue, 29 Jul 2025 12:30:00 +0000

Type Values Removed Values Added
Title firefox: Search terms persisted in URL bar
References
Metrics threat_severity

None

 threat_severity

Low

Mon, 28 Jul 2025 14:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*

Wed, 23 Jul 2025 17:45:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Mozilla firefox Esr
Mozilla thunderbird
Vendors & Products Mozilla
Mozilla firefox
Mozilla firefox Esr
Mozilla thunderbird

Wed, 23 Jul 2025 14:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 22 Jul 2025 21:00:00 +0000

Type Values Removed Values Added
Description In some cases search terms persisted in the URL bar even after navigating away from the search page. This vulnerability affects Firefox < 141, Firefox ESR < 140.1, Thunderbird < 141, and Thunderbird < 140.1.
References

Subscriptions

Mozilla Firefox Firefox Esr Thunderbird
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-04-13T14:27:04.816Z

Reserved: 2025-07-22T10:14:08.352Z

Link: CVE-2025-8039

cve-icon Vulnrichment

Updated: 2025-07-23T13:42:58.850Z

cve-icon NVD

Status : Modified

Published: 2025-07-22T21:15:51.060

Modified: 2026-04-13T15:17:11.200

Link: CVE-2025-8039

cve-icon Redhat

Severity : Low

Publid Date: 2025-07-22T20:49:27Z

Links: CVE-2025-8039 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-20T17:00:12Z

Weaknesses