Early Access — Mondoo Vulnerability Intelligence is currently in preview.

UBUNTU-CVE-2025-6427

CRITICAL9.1

An attacker was able to bypass the `connect-src` directive of a Content Security Policy by manipulating subdocuments. This would have also hidden the connections from the Network tab in Devtools. This

Published Jun 24, 2025

Modified 6 months ago

No fix available

Details

An attacker was able to bypass the connect-src directive of a Content Security Policy by manipulating subdocuments. This would have also hidden the connections from the Network tab in Devtools. This vulnerability affects Firefox < 140.

Affected Packages

Ubuntu:22.04:LTSmozjs102

Affected versions:

102.11.0-0ubuntu0.22.04.1102.12.0-0ubuntu0.22.04.1102.13.0-0ubuntu0.22.04.1102.15.1-0ubuntu0.22.04.1

Ubuntu:24.04:LTSmozjs102

Affected versions:

102.15.1-1102.15.1-3ubuntu2

Ubuntu:24.10mozjs115

Affected versions:

115.10.0-1115.11.0-1115.12.0-1115.12.0-1build1115.13.0-1115.14.0-1115.16.0-1

Ubuntu:25.04mozjs115

Affected versions:

115.16.0-1115.17.0-1115.18.0-1115.19.0-1115.20.0-1115.21.0-1

Ubuntu:24.04:LTSmozjs115

Affected versions:

115.10.0-1115.3.0-0ubuntu1115.4.0-2115.5.0-1115.6.0-1115.7.0-4115.8.0-1115.9.0-1115.9.0-1build1

Ubuntu:Pro:18.04:LTSmozjs38

Affected versions:

38.8.0~repack1-0ubuntu138.8.0~repack1-0ubuntu338.8.0~repack1-0ubuntu4

Ubuntu:Pro:20.04:LTSmozjs52

Affected versions:

52.9.1-1build152.9.1-1ubuntu3

Ubuntu:Pro:18.04:LTSmozjs52

Affected versions:

52.3.1-0ubuntu352.3.1-7fakesync152.8.1-0ubuntu0.18.04.152.9.1-0ubuntu0.18.04.1

Ubuntu:18.04:LTSmozjs52

Affected versions:

52.3.1-0ubuntu352.3.1-7fakesync152.8.1-0ubuntu0.18.04.152.9.1-0ubuntu0.18.04.1

Ubuntu:Pro:20.04:LTSmozjs68

Affected versions:

68.5.0-1~fakesync68.5.0-2~fakesync68.6.0-168.6.0-1ubuntu1

Ubuntu:20.04:LTSmozjs68

Affected versions:

68.5.0-1~fakesync68.5.0-2~fakesync68.6.0-168.6.0-1ubuntu1

Ubuntu:22.04:LTSmozjs78

Affected versions:

78.13.0-178.15.0-278.15.0-4ubuntu1

Ubuntu:22.04:LTSmozjs91

Affected versions:

91.10.0-0ubuntu191.5.1-0ubuntu191.6.0-191.6.0-291.7.0-2

Ubuntu:22.04:LTSthunderbird

Affected versions:

1:102.10.0+build2-0ubuntu0.22.04.11:102.11.0+build1-0ubuntu0.22.04.11:102.13.0+build1-0ubuntu0.22.04.11:102.15.0+build1-0ubuntu0.22.04.11:102.15.1+build1-0ubuntu0.22.04.11:102.2.2+build1-0ubuntu0.22.04.11:102.4.2+build2-0ubuntu0.22.04.11:102.7.1+build2-0ubuntu0.22.04.11:102.8.0+build2-0ubuntu0.22.04.11:102.9.0+build1-0ubuntu0.22.04.1+27 more

References

REPORThttps://bugzilla.mozilla.org/show_bug.cgi?id=1966927 REPORThttps://ubuntu.com/security/CVE-2025-6427 REPORThttps://www.cve.org/CVERecord?id=CVE-2025-6427 REPORThttps://www.mozilla.org/en-US/security/advisories/mfsa2025-51/#CVE-2025-6427 REPORThttps://www.mozilla.org/security/advisories/mfsa2025-51/

CVSS Analysis

CVSS v3.1

9.1

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

UnchangedS:U

Impact

Confidentiality

HighC:H

Integrity

HighI:H

Availability

NoneA:N

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CVE-2025-6427

Ecosystems

Ubuntu 22.04 LTS Ubuntu 24.04 LTS Ubuntu 24.10 Ubuntu 25.04 Ubuntu Pro 18.04 LTS Ubuntu Pro 20.04 LTS Ubuntu 18.04 LTS Ubuntu 20.04 LTS

Timeline

PublishedJun 24, 2025

ModifiedJun 26, 2025

UBUNTU-CVE-2025-6427 | Mondoo Vulnerability Intelligence

UBUNTU-CVE-2025-6427

Details

Affected Packages

References

CVSS Analysis

Related

Ecosystems

Timeline