CVE-2025-8043
Incorrect URL truncation
9.8 Critical
Focus incorrectly truncated URLs towards the beginning instead of around the origin. This vulnerability was fixed in Firefox 141.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
0.43%Up 0.4 points since Jul 23, 2025
What each source reports
CVE List Score used
Incorrect URL truncation
Focus incorrectly truncated URLs towards the beginning instead of around the origin. This vulnerability was fixed in Firefox 141.
- Record
CVE-2025-8043- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-451
- Updated
- 2026-11-02
EUVDEUVD-2025-22358
Focus incorrectly truncated URLs towards the beginning instead of around the origin. This vulnerability was fixed in Firefox 141.
- Record
EUVD-2025-22358- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-ww6j-fhx6-wrxh
Focus incorrectly truncated URLs towards the beginning instead of around the origin. This...
Focus incorrectly truncated URLs towards the beginning instead of around the origin. This vulnerability affects Firefox < 141 and Thunderbird < 141.
- Record
GHSA-ww6j-fhx6-wrxh- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-451
- Updated
- 2026-11-02
NVD
Focus incorrectly truncated URLs towards the beginning instead of around the origin. This vulnerability was fixed in Firefox 141.
- Record
CVE-2025-8043- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-451
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-8043
Focus incorrectly truncated URLs towards the beginning instead of around the origin. This vulnerability was fixed in Firefox 141.
- Record
UBUNTU-CVE-2025-8043- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15386-1 No score
MozillaFirefox-141.0-1.1 on GA media
These are all security issues fixed in the MozillaFirefox-141.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15386-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11373-1 No score
firefox-esr-153.0-1.1 on GA media
These are all security issues fixed in the firefox-esr-153.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11373-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mozjs52Ubuntu:18.04:LTS |
All versions, plus listed versions 52.3.1-0ubuntu352.3.1-7fakesync152.8.1-0ubuntu0.18.04.152.9.1-0ubuntu0.18.04.1 |
None known |
mozjs38Ubuntu:18.04:LTS |
All versions, plus listed versions 38.8.0~repack1-0ubuntu138.8.0~repack1-0ubuntu338.8.0~repack1-0ubuntu4 |
None known |
mozjs68Ubuntu:20.04:LTS |
All versions, plus listed versions 68.5.0-1~fakesync68.5.0-2~fakesync68.6.0-168.6.0-1ubuntu1 |
None known |
mozjs52Ubuntu:20.04:LTS |
All versions, plus listed versions 52.9.1-1build152.9.1-1ubuntu3 |
None known |
mozjs102Ubuntu:22.04:LTS |
All versions, plus listed versions 102.11.0-0ubuntu0.22.04.1102.12.0-0ubuntu0.22.04.1102.13.0-0ubuntu0.22.04.1102.15.1-0ubuntu0.22.04.1 |
None known |
mozjs78Ubuntu:22.04:LTS |
All versions, plus listed versions 78.13.0-178.15.0-278.15.0-4ubuntu1 |
None known |
mozjs91Ubuntu:22.04:LTS |
All versions, plus listed versions 91.5.1-0ubuntu191.6.0-191.6.0-291.7.0-291.10.0-0ubuntu1 |
None known |
mozjs102Ubuntu:24.04:LTS |
All versions, plus listed versions 102.15.1-1102.15.1-3ubuntu2 |
None known |
mozjs115Ubuntu:24.04:LTS |
All versions, plus listed versions 115.3.0-0ubuntu1115.4.0-2115.5.0-1115.6.0-1115.7.0-4 Show 4 moreShow less115.8.0-1115.9.0-1115.9.0-1build1115.10.0-1 |
None known |
MozillaFirefoxopenSUSE:Tumbleweed From an advisory covering 18 CVEs |
before 141.0-1.1 | 141.0-1.1 |
firefox-esropenSUSE:Tumbleweed From an advisory covering 228 CVEs |
before 153.0-1.1 | 153.0-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-8043 is a critical vulnerability (CVSS 9.8) in Mozilla Firefox, published July 22, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 37th percentile. No source names a fixed version.
References
bugzilla.mozilla.org/show_bug.cgi?id=1970209
mozilla.org/security/advisories/mfsa2025-56
nvd.nist.gov/vuln/detail/CVE-2025-8043
github.com/advisories/GHSA-ww6j-fhx6-wrxh
ubuntu.com/security/CVE-2025-8043
Show 194 moreShow less
cve.org/CVERecord?id=CVE-2025-8043
suse.com/security/cve/CVE-2025-8027
This page doesn't list everything
Left out here: 50 references. The JSON record has them.