Early Access — Mondoo Vulnerability Intelligence is currently in preview.

UBUNTU-CVE-2025-6425

MEDIUM5.5

An attacker who enumerated resources from the WebCompat extension could have obtained a persistent UUID that identified the browser, and persisted between containers and normal/private browsing mode,

Published Jun 24, 2025

Modified 6 months ago

No fix available

Details

An attacker who enumerated resources from the WebCompat extension could have obtained a persistent UUID that identified the browser, and persisted between containers and normal/private browsing mode, but not profiles. This vulnerability affects Firefox < 140, Firefox ESR < 115.25, Firefox ESR < 128.12, Thunderbird < 140, and Thunderbird < 128.12.

Affected Packages

Ubuntu:22.04:LTSmozjs102

Affected versions:

102.11.0-0ubuntu0.22.04.1102.12.0-0ubuntu0.22.04.1102.13.0-0ubuntu0.22.04.1102.15.1-0ubuntu0.22.04.1

Ubuntu:24.04:LTSmozjs102

Affected versions:

102.15.1-1102.15.1-3ubuntu2

Ubuntu:24.10mozjs115

Affected versions:

115.10.0-1115.11.0-1115.12.0-1115.12.0-1build1115.13.0-1115.14.0-1115.16.0-1

Ubuntu:25.04mozjs115

Affected versions:

115.16.0-1115.17.0-1115.18.0-1115.19.0-1115.20.0-1115.21.0-1

Ubuntu:24.04:LTSmozjs115

Affected versions:

115.10.0-1115.3.0-0ubuntu1115.4.0-2115.5.0-1115.6.0-1115.7.0-4115.8.0-1115.9.0-1115.9.0-1build1

Ubuntu:Pro:18.04:LTSmozjs38

Affected versions:

38.8.0~repack1-0ubuntu138.8.0~repack1-0ubuntu338.8.0~repack1-0ubuntu4

Ubuntu:Pro:20.04:LTSmozjs52

Affected versions:

52.9.1-1build152.9.1-1ubuntu3

Ubuntu:Pro:18.04:LTSmozjs52

Affected versions:

52.3.1-0ubuntu352.3.1-7fakesync152.8.1-0ubuntu0.18.04.152.9.1-0ubuntu0.18.04.1

Ubuntu:18.04:LTSmozjs52

Affected versions:

52.3.1-0ubuntu352.3.1-7fakesync152.8.1-0ubuntu0.18.04.152.9.1-0ubuntu0.18.04.1

Ubuntu:Pro:20.04:LTSmozjs68

Affected versions:

68.5.0-1~fakesync68.5.0-2~fakesync68.6.0-168.6.0-1ubuntu1

Ubuntu:20.04:LTSmozjs68

Affected versions:

68.5.0-1~fakesync68.5.0-2~fakesync68.6.0-168.6.0-1ubuntu1

Ubuntu:22.04:LTSmozjs78

Affected versions:

78.13.0-178.15.0-278.15.0-4ubuntu1

Ubuntu:22.04:LTSmozjs91

Affected versions:

91.10.0-0ubuntu191.5.1-0ubuntu191.6.0-191.6.0-291.7.0-2

Ubuntu:22.04:LTSthunderbird

Affected versions:

1:102.10.0+build2-0ubuntu0.22.04.11:102.11.0+build1-0ubuntu0.22.04.11:102.13.0+build1-0ubuntu0.22.04.11:102.15.0+build1-0ubuntu0.22.04.11:102.15.1+build1-0ubuntu0.22.04.11:102.2.2+build1-0ubuntu0.22.04.11:102.4.2+build2-0ubuntu0.22.04.11:102.7.1+build2-0ubuntu0.22.04.11:102.8.0+build2-0ubuntu0.22.04.11:102.9.0+build1-0ubuntu0.22.04.1+27 more

References

REPORThttps://bugzilla.mozilla.org/show_bug.cgi?id=1717672 REPORThttps://ubuntu.com/security/CVE-2025-6425 REPORThttps://www.cve.org/CVERecord?id=CVE-2025-6425 REPORThttps://www.mozilla.org/en-US/security/advisories/mfsa2025-51/#CVE-2025-6425 REPORThttps://www.mozilla.org/en-US/security/advisories/mfsa2025-53/#CVE-2025-6425 REPORThttps://www.mozilla.org/security/advisories/mfsa2025-51/REPORThttps://www.mozilla.org/security/advisories/mfsa2025-52/REPORThttps://www.mozilla.org/security/advisories/mfsa2025-53/

CVSS Analysis

CVSS v3.1

5.5

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

RequiredUI:R

Scope

UnchangedS:U

Impact

Confidentiality

LowC:L

Integrity

NoneI:N

Availability

NoneA:N

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Upstream

CVE-2025-6425

Ecosystems

Ubuntu 22.04 LTS Ubuntu 24.04 LTS Ubuntu 24.10 Ubuntu 25.04 Ubuntu Pro 18.04 LTS Ubuntu Pro 20.04 LTS Ubuntu 18.04 LTS Ubuntu 20.04 LTS

Timeline

PublishedJun 24, 2025

ModifiedJul 11, 2025

UBUNTU-CVE-2025-6425 | Mondoo Vulnerability Intelligence