How to fix CVE-2025-8039?

Within 24 hours: Inventory Firefox and Thunderbird installations across the organization and identify systems running versions prior to Firefox 141 (or ESR 140.1) and Thunderbird 141 (or ESR 140.1). Within 7 days: Communicate advisory to end users emphasizing avoidance of URL bar screenshots and sharing; implement browser auto-update enforcement if available. Within 30 days: Mandate upgrade to Firefox 141+ (or ESR 140.1+) and Thunderbird 141+ (or ESR 140.1+) across all managed endpoints; verify completion via endpoint management tools.

Is Thunderbird affected by CVE-2025-8039?

Mozilla Firefox and Thunderbird contain a URL bar flaw that exposes users' search queries and sensitive information when URLs are shared, screenshotted, or exported from browser history.

CVE-2025-8039

HIGH

2025-07-22 [email protected]

Mozilla Information Disclosure Thunderbird Redhat Suse

8.1

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 13, 2026 - 15:42 vuln.today

DescriptionNVD

In some cases search terms persisted in the URL bar even after navigating away from the search page. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1.

AnalysisAI

Search term leakage in Mozilla Firefox and Thunderbird URL bars exposes sensitive user queries to unauthorized parties when URLs are shared or logged. Firefox versions prior to 141 (regular) and 140.1 (ESR), and Thunderbird versions prior to 141 (regular) and 140.1 (ESR) fail to properly clear search parameters from the URL bar after navigation, enabling information disclosure through shoulder surfing, screenshot sharing, browser history exports, or URL-based tracking. No public exploit identified at time of analysis, though the attack requires only user interaction (EPSS data not provided). CVSS 8.1 reflects high confidentiality and integrity impact despite requiring user interaction.

Technical ContextAI

This vulnerability stems from improper output neutralization for logs (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) in Mozilla's URL bar implementation. Modern browsers typically sanitize or clear sensitive URL parameters after navigation to prevent inadvertent disclosure, but affected Firefox and Thunderbird versions failed to implement this protection for search queries. The URL bar is a critical UI component that displays and stores navigation history, making it a potential vector for information leakage when users share screenshots, copy URLs for collaboration, or when browser sync/logging mechanisms capture URL history. The affected products span both Firefox (standalone browser) and Thunderbird (email client with integrated web browsing), across both regular release channels and Extended Support Release (ESR) branches designed for enterprise deployments.

RemediationAI

Upgrade Firefox to version 141 or later for standard release channel users, or to version 140.1 or later for Extended Support Release (ESR) deployments. Thunderbird users should upgrade to version 141 (standard) or 140.1 (ESR) respectively. Patches are available through Mozilla's standard update mechanisms including automatic updates, manual downloads from mozilla.org, and enterprise deployment tools like Firefox ESR distribution packages. Consult the official Mozilla security advisories at https://www.mozilla.org/security/advisories/mfsa2025-56/ (Firefox), https://www.mozilla.org/security/advisories/mfsa2025-59/ (Firefox ESR), https://www.mozilla.org/security/advisories/mfsa2025-61/ (Thunderbird), and https://www.mozilla.org/security/advisories/mfsa2025-63/ (Thunderbird ESR) for product-specific update instructions. No workarounds are documented; patching is the only definitive mitigation. Enterprise administrators should prioritize ESR updates for managed deployments and verify update completion through endpoint management systems.

Vendor StatusVendor

CVE-2025-8039 vulnerability details – vuln.today

Back