XSLT document loading did not correctly propagate the source document which bypassed its CSP. This vulnerability was fixed in Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1.
References
| Link | Resource |
|---|---|
| https://bugzilla.mozilla.org/show_bug.cgi?id=1974407 | Permissions Required |
| https://www.mozilla.org/security/advisories/mfsa2025-56/ | Vendor Advisory |
| https://www.mozilla.org/security/advisories/mfsa2025-58/ | Vendor Advisory |
| https://www.mozilla.org/security/advisories/mfsa2025-59/ | Vendor Advisory |
| https://www.mozilla.org/security/advisories/mfsa2025-61/ | Vendor Advisory |
| https://www.mozilla.org/security/advisories/mfsa2025-62/ | Vendor Advisory |
| https://www.mozilla.org/security/advisories/mfsa2025-63/ | Vendor Advisory |
| https://lists.debian.org/debian-lts-announce/2025/07/msg00016.html |
Configurations
Configuration 1 (hide)
|
History
05 Oct 2026, 15:10
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (es) La carga de documentos XSLT no propagó correctamente el documento fuente, lo que eludió su CSP. Esta vulnerabilidad afecta a Firefox menor que 141, Firefox ESR menor que 128.13, Firefox ESR menor que 140.1, Thunderbird menor que 141, Thunderbird menor que 128.13 y Thunderbird menor que 140.1. |
30 Sep 2026, 18:10
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (es) La carga de documentos XSLT no propagó correctamente el documento fuente, lo que eludió su CSP. Esta vulnerabilidad afecta a Firefox < 141, Firefox ESR < 128.13, Firefox ESR < 140.1, Thunderbird < 141, Thunderbird < 128.13 y Thunderbird < 140.1. |
Information
Published : 2025-07-22 21:15
Updated : 2026-10-05 15:10
NVD link : CVE-2025-8032
Mitre link : CVE-2025-8032
CVE.ORG link : CVE-2025-8032
JSON object : View
Products Affected
mozilla
- firefox
- thunderbird
CWE
CWE-693
Protection Mechanism Failure