CVE-2025-8037
CRITICALCVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
1DescriptionNVD
Setting a nameless cookie with an equals sign in the value shadowed other cookies. Even if the nameless cookie was set over HTTP and the shadowed cookie included the Secure attribute. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1.
AnalysisAI
Cookie shadowing in Mozilla Firefox (versions prior to 141 and ESR prior to 140.1) and Thunderbird (versions prior to 141 and ESR prior to 140.1) allows remote unauthenticated attackers to bypass Secure cookie protections and access or modify session data. A nameless cookie containing an equals sign set over insecure HTTP can override cookies with the Secure attribute, enabling session hijacking or authentication bypass. No public exploit identified at time of analysis, though the attack complexity is low (CVSS AC:L) with network-based attack vector requiring no user interaction.
Technical ContextAI
This vulnerability exploits cookie parsing logic in Mozilla's network stack (CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute). The core issue involves how Firefox and Thunderbird handle malformed cookies: specifically, nameless cookies (cookies without a name before the equals sign) that contain an equals sign in their value portion. Due to incorrect precedence handling in the cookie jar implementation, these malformed cookies can shadow legitimate cookies even when the legitimate cookie includes security attributes like 'Secure' (which should restrict the cookie to HTTPS-only transmission). The vulnerability affects both Firefox ESR (Extended Support Release) and standard release channels, as well as Thunderbird email client which shares Mozilla's networking code. The CPE strings identify affected products as mozilla:firefox (both standard and ESR builds) and mozilla:thunderbird (both standard and ESR builds), all versions prior to the January 2025 patches.
RemediationAI
Vendor-released patches are available: upgrade Firefox to version 141 or later, Firefox ESR to version 140.1 or later, Thunderbird to version 141 or later, or Thunderbird ESR to version 140.1 or later. Organizations should prioritize immediate deployment of these updates through existing patch management systems, particularly for Firefox ESR and Thunderbird ESR channels commonly used in enterprise environments. No effective workarounds exist beyond upgrading, as the vulnerability resides in core cookie handling logic that cannot be disabled without breaking legitimate functionality. Detailed advisory information and download links are available at Mozilla Security Advisories MFSA2025-56, MFSA2025-59, MFSA2025-61, and MFSA2025-63 (https://www.mozilla.org/security/advisories/). System administrators should verify successful update deployment and confirm running patched versions through browser/client version checks.
Vendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today