CVE-2025-10534
Spoofing issue in the Site Permissions component
8.1 High
Spoofing issue in the Site Permissions component. This vulnerability was fixed in Firefox 143 and Thunderbird 143.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
0.36%Up 0.3 points since Sep 17, 2025
What each source reports
CVE List Score used
Spoofing issue in the Site Permissions component
Spoofing issue in the Site Permissions component. This vulnerability was fixed in Firefox 143 and Thunderbird 143.
- Record
CVE-2025-10534- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2025-29554
Spoofing issue in the Site Permissions component. This vulnerability was fixed in Firefox 143 and Thunderbird 143.
- Record
EUVD-2025-29554- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-pww6-475j-f225
This vulnerability affects Firefox < 143 and Thunderbird < 143.
This vulnerability affects Firefox < 143 and Thunderbird < 143.
- Record
GHSA-pww6-475j-f225- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
Spoofing issue in the Site Permissions component. This vulnerability was fixed in Firefox 143 and Thunderbird 143.
- Record
CVE-2025-10534- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-10534
Spoofing issue in the Site Permissions component. This vulnerability affects Firefox < 143 and Thunderbird < 143.
- Record
UBUNTU-CVE-2025-10534- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15565-1No score
MozillaFirefox-143.0-1.1 on GA media
These are all security issues fixed in the MozillaFirefox-143.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15565-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11373-1No score
firefox-esr-153.0-1.1 on GA media
These are all security issues fixed in the firefox-esr-153.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11373-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
MozillaFirefoxopenSUSE:Tumbleweed From an advisory covering 11 CVEs | before 143.0-1.1 | 143.0-1.1 |
firefox-esropenSUSE:Tumbleweed From an advisory covering 228 CVEs | before 153.0-1.1 | 153.0-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-10534 is a high vulnerability (CVSS 8.1) in Mozilla Firefox, published September 16, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 29th percentile. No source names a fixed version.
References
bugzilla.mozilla.org/show_bug.cgi?id=1665334
mozilla.org/security/advisories/mfsa2025-73
nvd.nist.gov/vuln/detail/CVE-2025-10534
github.com/advisories/GHSA-pww6-475j-f225
ubuntu.com/security/CVE-2025-10534
Show 194 moreShow less
cve.org/CVERecord?id=CVE-2025-10534
suse.com/security/cve/CVE-2025-10527
This page doesn't list everything
Left out here: 43 references. The JSON record has them.