{"id":"CVE-2025-6426","aliases":["EUVD-2025-19102","GHSA-9x34-3cq7-4hf6","SUSE-SU-2025:02122-1","SUSE-SU-2025:02123-1","SUSE-SU-2025:02339-1","SUSE-SU-2025:02368-1","SUSE-SU-2025:02529-1","SUSE-SU-2025:02546-1","SUSE-SU-2025:21170-1","UBUNTU-CVE-2025-6426","USN-7663-1","openSUSE-SU-2025-20135-1","openSUSE-SU-2025:15216-1","openSUSE-SU-2025:15312-1","openSUSE-SU-2025:15315-1","openSUSE-SU-2025:15325-1","openSUSE-SU-2025:20135-1"],"status":"published","title":"No warning when opening executable terminal files on macOS","description":"The executable file warning did not warn users before opening files with the `terminal` extension. \n*This bug only affects Firefox for macOS. Other versions of Firefox are unaffected.*. This vulnerability was fixed in Firefox 140, Firefox ESR 128.12, Thunderbird 140, and Thunderbird 128.12.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00205,"percentile":0.10514,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-345"],"published":"2025-06-24T12:28:00Z","modified":"2026-10-28T20:15:56Z","fixes":[{"ecosystem":"Ubuntu:22.04:LTS","package":"thunderbird","fixed_in":["1:128.12.0+build1-0ubuntu0.22.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP6","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"128.12.0-150200.152.188.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"128.12.0-150200.152.188.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"128.12.0-150200.152.188.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"128.12.0-150200.152.188.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"128.12.0-150200.152.188.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"128.12.0-150200.152.188.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"128.12.0-150200.152.188.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"128.12.0-150200.152.188.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"128.12.0-150200.152.188.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"128.12.0-150200.152.188.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"128.12.0-150200.152.188.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"128.12.0-150200.152.188.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"128.12.0-150200.152.188.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"128.12.0-150200.152.188.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"128.12.0-150200.152.188.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"128.12.0-112.265.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"128.12.0-112.265.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.0-112.270.2"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"MozillaFirefox-branding-SLE","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140-35.19.5"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.0-112.270.2"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"MozillaFirefox-branding-SLE","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140-35.19.5"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"128.12.0-150200.8.227.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"128.12.0-150200.8.227.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP6","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"128.12.0-150200.8.227.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"128.12.0-150200.8.227.2"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"128.12.0-150200.8.227.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP6","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.1.0-150200.152.193.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP6","package":"MozillaFirefox-branding-SLE","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140-150200.9.21.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.1.0-150200.152.193.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"MozillaFirefox-branding-SLE","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140-150200.9.21.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"pipewire","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.6-150200.3.11.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"pipewire","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.6-150200.3.11.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.1.0-150200.152.193.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"MozillaFirefox-branding-SLE","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140-150200.9.21.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"pipewire","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.24-150300.4.8.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"xdg-desktop-portal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150200.5.8.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.1.0-150200.152.193.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"MozillaFirefox-branding-SLE","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140-150200.9.21.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"pipewire","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.49-150400.3.7.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"xdg-desktop-portal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-150400.3.8.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.1.0-150200.152.193.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"MozillaFirefox-branding-SLE","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140-150200.9.21.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"pipewire","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.49-150400.3.7.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"xdg-desktop-portal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-150400.3.8.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.1.0-150200.152.193.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"MozillaFirefox-branding-SLE","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140-150200.9.21.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"pipewire","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.64-150500.3.7.2"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"xdg-desktop-portal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-150500.3.8.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.1.0-150200.152.193.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"MozillaFirefox-branding-SLE","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140-150200.9.21.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"pipewire","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.64-150500.3.7.2"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"xdg-desktop-portal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-150500.3.8.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.1.0-150200.152.193.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"MozillaFirefox-branding-SLE","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140-150200.9.21.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"pipewire","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.24-150300.4.8.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"xdg-desktop-portal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150200.5.8.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.1.0-150200.152.193.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"MozillaFirefox-branding-SLE","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140-150200.9.21.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"pipewire","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.49-150400.3.7.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"xdg-desktop-portal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-150400.3.8.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.1.0-150200.152.193.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"MozillaFirefox-branding-SLE","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140-150200.9.21.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"pipewire","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.64-150500.3.7.2"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"xdg-desktop-portal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-150500.3.8.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.1.0-150200.152.193.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"MozillaFirefox-branding-SLE","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140-150200.9.21.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"pipewire","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.24-150300.4.8.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"xdg-desktop-portal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150200.5.8.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.1.0-150200.152.193.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"MozillaFirefox-branding-SLE","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140-150200.9.21.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"pipewire","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.49-150400.3.7.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"xdg-desktop-portal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-150400.3.8.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.1.0-150200.152.193.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"MozillaFirefox-branding-SLE","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140-150200.9.21.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"pipewire","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.64-150500.3.7.2"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"xdg-desktop-portal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-150500.3.8.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.1.0-150200.152.193.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"MozillaFirefox-branding-SLE","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140-150200.9.21.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"pipewire","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.24-150300.4.8.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"xdg-desktop-portal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150200.5.8.1"}]}],"bundled":27},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.1.0-150200.152.193.1"}]}],"bundled":27},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"MozillaFirefox-branding-SLE","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140-150200.9.21.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.1.0-150200.8.230.1"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.1.0-150200.8.230.1"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP6","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.1.0-150200.8.230.1"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.1.0-150200.8.230.1"}]}],"bundled":25},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.1.0-150200.8.230.1"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"mozjs128","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"128.14.0-160000.1.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"mozjs128","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"128.14.0-160000.1.1"}]}],"bundled":26},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mozjs52","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["52.3.1-0ubuntu3","52.3.1-7fakesync1","52.8.1-0ubuntu0.18.04.1","52.9.1-0ubuntu0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mozjs38","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["38.8.0~repack1-0ubuntu1","38.8.0~repack1-0ubuntu3","38.8.0~repack1-0ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mozjs68","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["68.5.0-1~fakesync","68.5.0-2~fakesync","68.6.0-1","68.6.0-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mozjs52","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["52.9.1-1build1","52.9.1-1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"mozjs102","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["102.11.0-0ubuntu0.22.04.1","102.12.0-0ubuntu0.22.04.1","102.13.0-0ubuntu0.22.04.1","102.15.1-0ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"mozjs78","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["78.13.0-1","78.15.0-2","78.15.0-4ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"mozjs91","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["91.5.1-0ubuntu1","91.6.0-1","91.6.0-2","91.7.0-2","91.10.0-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:128.12.0+build1-0ubuntu0.22.04.1"}]}],"versions":["1:91.1.2+build1-0ubuntu1","1:91.3.0+build2-0ubuntu1","1:91.3.1+build1-0ubuntu1","1:91.3.2+build1-0ubuntu1","1:91.4.0+build1.1-0ubuntu1","1:91.4.0+build2-0ubuntu1","1:91.5.0+build1-0ubuntu1","1:91.5.1+build1-0ubuntu1","1:91.6.1+build1-0ubuntu1","1:91.7.0+build1-0ubuntu1","1:91.7.0+build2-0ubuntu1","1:91.8.0+build2-0ubuntu1","1:91.9.1+build1-0ubuntu0.22.04.1","1:91.11.0+build2-0ubuntu0.22.04.1","1:102.2.2+build1-0ubuntu0.22.04.1","1:102.4.2+build2-0ubuntu0.22.04.1","1:102.7.1+build2-0ubuntu0.22.04.1","1:102.8.0+build2-0ubuntu0.22.04.1","1:102.9.0+build1-0ubuntu0.22.04.1","1:102.10.0+build2-0ubuntu0.22.04.1","1:102.11.0+build1-0ubuntu0.22.04.1","1:102.13.0+build1-0ubuntu0.22.04.1","1:102.15.0+build1-0ubuntu0.22.04.1","1:102.15.1+build1-0ubuntu0.22.04.1","1:115.3.1+build1-0ubuntu0.22.04.2","1:115.4.1+build1-0ubuntu0.22.04.1","1:115.5.0+build1-0ubuntu0.22.04.1","1:115.6.0+build2-0ubuntu0.22.04.1","1:115.8.1+build1-0ubuntu0.22.04.1","1:115.9.0+build1-0ubuntu0.22.04.1","1:115.10.1+build1-0ubuntu0.22.04.1","1:115.11.0+build2-0ubuntu0.22.04.1","1:115.12.0+build3-0ubuntu0.22.04.1","1:115.13.0+build5-0ubuntu0.22.04.1","1:115.15.0+build1-0ubuntu0.22.04.1","1:115.16.0+build2-0ubuntu0.22.04.1","1:115.18.0+build1-0ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"mozjs102","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["102.15.1-1","102.15.1-3ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"mozjs115","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["115.3.0-0ubuntu1","115.4.0-2","115.5.0-1","115.6.0-1","115.7.0-4","115.8.0-1","115.9.0-1","115.9.0-1build1","115.10.0-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:128.12.0+build1-0ubuntu0.22.04.1"}]}],"versions":["1:91.1.2+build1-0ubuntu1","1:91.3.0+build2-0ubuntu1","1:91.3.1+build1-0ubuntu1","1:91.3.2+build1-0ubuntu1","1:91.4.0+build1.1-0ubuntu1","1:91.4.0+build2-0ubuntu1","1:91.5.0+build1-0ubuntu1","1:91.5.1+build1-0ubuntu1","1:91.6.1+build1-0ubuntu1","1:91.7.0+build1-0ubuntu1","1:91.7.0+build2-0ubuntu1","1:91.8.0+build2-0ubuntu1","1:91.9.1+build1-0ubuntu0.22.04.1","1:91.11.0+build2-0ubuntu0.22.04.1","1:102.2.2+build1-0ubuntu0.22.04.1","1:102.4.2+build2-0ubuntu0.22.04.1","1:102.7.1+build2-0ubuntu0.22.04.1","1:102.8.0+build2-0ubuntu0.22.04.1","1:102.9.0+build1-0ubuntu0.22.04.1","1:102.10.0+build2-0ubuntu0.22.04.1","1:102.11.0+build1-0ubuntu0.22.04.1","1:102.13.0+build1-0ubuntu0.22.04.1","1:102.15.0+build1-0ubuntu0.22.04.1","1:102.15.1+build1-0ubuntu0.22.04.1","1:115.3.1+build1-0ubuntu0.22.04.2","1:115.4.1+build1-0ubuntu0.22.04.1","1:115.5.0+build1-0ubuntu0.22.04.1","1:115.6.0+build2-0ubuntu0.22.04.1","1:115.8.1+build1-0ubuntu0.22.04.1","1:115.9.0+build1-0ubuntu0.22.04.1","1:115.10.1+build1-0ubuntu0.22.04.1","1:115.11.0+build2-0ubuntu0.22.04.1","1:115.12.0+build3-0ubuntu0.22.04.1","1:115.13.0+build5-0ubuntu0.22.04.1","1:115.15.0+build1-0ubuntu0.22.04.1","1:115.16.0+build2-0ubuntu0.22.04.1","1:115.18.0+build1-0ubuntu0.22.04.1"],"bundled":52},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"firefox-esr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"128.12.0-1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"128.12.0-1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"mozjs128","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"128.12.0-1.1"}]}],"bundled":13},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.0.2-1.1"}]}],"bundled":13},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"mozjs128","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"128.14.0-160000.1.1"}]}],"bundled":26}],"products":[{"vendor":"mozilla","product":"firefox"},{"vendor":"mozilla","product":"thunderbird"}],"references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1964385","tags":["Permissions Required","report"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2025-51/","tags":["Vendor Advisory","report"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2025-53/","tags":["Vendor Advisory","report"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2025-54/"},{"url":"https://www.mozilla.org/security/advisories/mfsa2025-55/"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-6426"},{"url":"https://www.mozilla.org/security/advisories/mfsa2025-51"},{"url":"https://www.mozilla.org/security/advisories/mfsa2025-53"},{"url":"https://www.mozilla.org/security/advisories/mfsa2025-54"},{"url":"https://www.mozilla.org/security/advisories/mfsa2025-55"},{"url":"https://github.com/advisories/GHSA-9x34-3cq7-4hf6"},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502122-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1244670","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6424","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6425","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6426","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6429","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6430","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502123-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502339-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6427","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6428","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6431","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6432","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6433","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6435","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6436","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502368-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502529-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1237231","tags":["report"]},{"url":"https://bugzilla.suse.com/1246664","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8027","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8028","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8029","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8030","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8031","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8034","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8035","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8036","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8040","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502546-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202521170-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1248162","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5263","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5264","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5265","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5266","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5267","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5268","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5269","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5283","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-9179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-9180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-9181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-9185","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-6426","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-6426","tags":["report"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2025-51/#CVE-2025-6426","tags":["report"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2025-53/#CVE-2025-6426","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7663-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-43097","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-0238","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-0242","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-0510","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-1009","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-1010","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-1011","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-1012","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-1013","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-1014","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-1015","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-1016","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-1017","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-1930","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-1931","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-1932","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-1933","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-1934","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-1935","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-1936","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-1937","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-1938","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-2830","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-3028","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-3029","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-3030","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-3522","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-3523","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-3875","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-3909","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-3932","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-4083","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-4087","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-4091","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-4093","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-4918","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-4919","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-5263","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-5264","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-5265","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-5266","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-5267","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-5268","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-5269","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-5986","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-6424","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-6425","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-6429","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-6430","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-26695","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-26696","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-6426","title":"No warning when opening executable terminal files on macOS","description":"The executable file warning did not warn users before opening files with the `terminal` extension. \n*This bug only affects Firefox for macOS. Other versions of Firefox are unaffected.*. This vulnerability was fixed in Firefox 140, Firefox ESR 128.12, Thunderbird 140, and Thunderbird 128.12.","status":"published","published":"2025-06-24T12:28:00.614Z","modified":"2026-04-13T14:30:40.735Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-345"],"updated_at":"2026-11-02T14:32:40.774223Z"}],"euvd":[{"id":"EUVD-2025-19102","description":"The executable file warning did not warn users before opening files with the `terminal` extension. \n*This bug only affects Firefox for macOS. Other versions of Firefox are unaffected.*. This vulnerability was fixed in Firefox 140, Firefox ESR 128.12, Thunderbird 140, and Thunderbird 128.12.","status":"published","published":"2025-06-24T12:28:00Z","modified":"2026-04-13T14:30:40Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:24:28.399811Z"}],"ghsa":[{"id":"GHSA-9x34-3cq7-4hf6","title":"The executable file warning did not warn users before opening files with the `terminal` extension...","description":"The executable file warning did not warn users before opening files with the `terminal` extension. \n*This bug only affects Firefox for macOS. Other versions of Firefox are unaffected.* This vulnerability affects Firefox \u003c 140 and Firefox ESR \u003c 128.12.","status":"published","published":"2025-06-26T21:31:06Z","modified":"2025-07-14T21:32:44Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-345"],"updated_at":"2026-11-02T15:03:01.086006Z"}],"nvd":[{"id":"CVE-2025-6426","description":"The executable file warning did not warn users before opening files with the `terminal` extension. \n*This bug only affects Firefox for macOS. Other versions of Firefox are unaffected.*. This vulnerability was fixed in Firefox 140, Firefox ESR 128.12, Thunderbird 140, and Thunderbird 128.12.","status":"published","published":"2025-06-24T13:15:23.537Z","modified":"2026-10-23T22:10:00.16Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-345"],"updated_at":"2026-11-02T14:11:14.091082Z"}],"osv":[{"id":"UBUNTU-CVE-2025-6426","description":"The executable file warning did not warn users before opening files with the `terminal` extension. *This bug only affects Firefox for macOS. Other versions of Firefox are unaffected.*. This vulnerability was fixed in Firefox 140, Firefox ESR 128.12, Thunderbird 140, and Thunderbird 128.12.","status":"published","published":"2025-06-24T13:15:00Z","modified":"2026-10-28T20:15:56.344586825Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:52.345622Z"},{"id":"openSUSE-SU-2025:15216-1","title":"firefox-esr-128.12.0-1.1 on GA media","description":"These are all security issues fixed in the firefox-esr-128.12.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-03T00:00:00Z","modified":"2026-03-23T04:53:29.81575Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"openSUSE-SU-2025:15312-1","title":"MozillaThunderbird-128.12.0-1.1 on GA media","description":"These are all security issues fixed in the MozillaThunderbird-128.12.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-06T00:00:00Z","modified":"2026-03-23T04:53:38.157799Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2025:15315-1","title":"libmozjs-128-0-128.12.0-1.1 on GA media","description":"These are all security issues fixed in the libmozjs-128-0-128.12.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-06T00:00:00Z","modified":"2026-03-23T04:53:38.148717Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2025:15325-1","title":"MozillaFirefox-140.0.2-1.1 on GA media","description":"These are all security issues fixed in the MozillaFirefox-140.0.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-09T00:00:00Z","modified":"2026-03-23T04:53:39.033181Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2025-20135-1","title":"Security update for mozjs128","description":"This update for mozjs128 fixes the following issues:\n\n- Update to version 128.14.0 (bsc#1248162):\n  + CVE-2025-9179: Sandbox escape due to invalid pointer in the\n    Audio/Video: GMP component\n  + CVE-2025-9180: Same-origin policy bypass in the Graphics:\n    Canvas2D component\n  + CVE-2025-9181: Uninitialized memory in the JavaScript Engine\n    component\n  + CVE-2025-9185: Memory safety bugs fixed in Firefox ESR 115.27,\n    Firefox ESR 128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,\n    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142\n\n- Update to version 128.13.0:\n  + CVE-2025-8027: JavaScript engine only wrote partial return\n    value to stack\n  + CVE-2025-8028: Large branch table could lead to truncated\n    instruction\n  + CVE-2025-8029: javascript: URLs executed on object and embed\n    tags\n  + CVE-2025-8030: Potential user-assisted code execution in “Copy\n    as cURL” command\n  + CVE-2025-8031: Incorrect URL stripping in CSP reports\n  + CVE-2025-8032: XSLT documents could bypass CSP\n  + CVE-2025-8033: Incorrect JavaScript state machine for\n    generators\n  + CVE-2025-8034: Memory safety bugs fixed in Firefox ESR 115.26,\n    Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,\n    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141\n  + CVE-2025-8035: Memory safety bugs fixed in Firefox ESR 128.13,\n    Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR\n    140.1, Firefox 141 and Thunderbird 141\n\n- Update to version 128.12.0:\n  + CVE-2025-6424: Use-after-free in FontFaceSet\n  + CVE-2025-6425: The WebCompat WebExtension shipped with Firefox\n    exposed a persistent UUID\n  + CVE-2025-6426: No warning when opening executable terminal\n    files on macOS\n  + CVE-2025-6429: Incorrect parsing of URLs could have allowed\n    embedding of youtube.com\n  + CVE-2025-6430: Content-Disposition header ignored when a file\n    is included in an embed or object tag\n\n- Update to version 128.11.0:\n  + CVE-2025-5283: Double-free in libvpx encoder\n  + CVE-2025-5263: Error handling for script execution was\n    incorrectly isolated from web content\n  + CVE-2025-5264: Potential local code execution in “Copy as cURL”\n    command\n  + CVE-2025-5265: Potential local code execution in “Copy as cURL”\n    command\n  + CVE-2025-5266: Script element events leaked cross-origin\n    resource status\n  + CVE-2025-5267: Clickjacking vulnerability could have led to\n    leaking saved payment card details\n  + CVE-2025-5268: Memory safety bugs fixed in Firefox 139,\n    Thunderbird 139, Firefox ESR 128.11, and Thunderbird 128.11\n  + CVE-2025-5269: Memory safety bug fixed in Firefox ESR 128.11\n    and Thunderbird 128.11\n","status":"withdrawn","published":"2025-12-03T20:41:04Z","modified":"2026-01-13T08:12:06.900833Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2025:20135-1","title":"Security update for mozjs128","description":"This update for mozjs128 fixes the following issues:\n\n- Update to version 128.14.0 (bsc#1248162):\n  + CVE-2025-9179: Sandbox escape due to invalid pointer in the\n    Audio/Video: GMP component\n  + CVE-2025-9180: Same-origin policy bypass in the Graphics:\n    Canvas2D component\n  + CVE-2025-9181: Uninitialized memory in the JavaScript Engine\n    component\n  + CVE-2025-9185: Memory safety bugs fixed in Firefox ESR 115.27,\n    Firefox ESR 128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,\n    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142\n\n- Update to version 128.13.0:\n  + CVE-2025-8027: JavaScript engine only wrote partial return\n    value to stack\n  + CVE-2025-8028: Large branch table could lead to truncated\n    instruction\n  + CVE-2025-8029: javascript: URLs executed on object and embed\n    tags\n  + CVE-2025-8030: Potential user-assisted code execution in “Copy\n    as cURL” command\n  + CVE-2025-8031: Incorrect URL stripping in CSP reports\n  + CVE-2025-8032: XSLT documents could bypass CSP\n  + CVE-2025-8033: Incorrect JavaScript state machine for\n    generators\n  + CVE-2025-8034: Memory safety bugs fixed in Firefox ESR 115.26,\n    Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,\n    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141\n  + CVE-2025-8035: Memory safety bugs fixed in Firefox ESR 128.13,\n    Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR\n    140.1, Firefox 141 and Thunderbird 141\n\n- Update to version 128.12.0:\n  + CVE-2025-6424: Use-after-free in FontFaceSet\n  + CVE-2025-6425: The WebCompat WebExtension shipped with Firefox\n    exposed a persistent UUID\n  + CVE-2025-6426: No warning when opening executable terminal\n    files on macOS\n  + CVE-2025-6429: Incorrect parsing of URLs could have allowed\n    embedding of youtube.com\n  + CVE-2025-6430: Content-Disposition header ignored when a file\n    is included in an embed or object tag\n\n- Update to version 128.11.0:\n  + CVE-2025-5283: Double-free in libvpx encoder\n  + CVE-2025-5263: Error handling for script execution was\n    incorrectly isolated from web content\n  + CVE-2025-5264: Potential local code execution in “Copy as cURL”\n    command\n  + CVE-2025-5265: Potential local code execution in “Copy as cURL”\n    command\n  + CVE-2025-5266: Script element events leaked cross-origin\n    resource status\n  + CVE-2025-5267: Clickjacking vulnerability could have led to\n    leaking saved payment card details\n  + CVE-2025-5268: Memory safety bugs fixed in Firefox 139,\n    Thunderbird 139, Firefox ESR 128.11, and Thunderbird 128.11\n  + CVE-2025-5269: Memory safety bug fixed in Firefox ESR 128.11\n    and Thunderbird 128.11\n","status":"published","published":"2025-12-03T20:41:04Z","modified":"2026-03-23T04:54:18.350454Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"SUSE-SU-2025:02122-1","title":"Security update for MozillaFirefox","description":"This update for MozillaFirefox fixes the following issues:\n\nUpdate to MozillaFirefox 128.12.0 (MFSA 2025-23, bsc#1244670):\n\n- CVE-2025-6424: Use-after-free in FontFaceSet\n- CVE-2025-6425: The WebCompat WebExtension shipped with Firefox exposed a persistent UUID\n- CVE-2025-6426: No warning when opening executable terminal files on macOS\n- CVE-2025-6429: Incorrect parsing of URLs could have allowed embedding of youtube.com\n- CVE-2025-6430: Content-Disposition header ignored when a file is included in an embed or object tag\n","status":"published","published":"2025-06-26T08:45:47Z","modified":"2026-03-23T04:49:34.587756Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:02123-1","title":"Security update for MozillaFirefox","description":"This update for MozillaFirefox fixes the following issues:\n\nUpdate to MozillaFirefox 128.12.0 (MFSA 2025-23, bsc#1244670):\n\n- CVE-2025-6424: Use-after-free in FontFaceSet\n- CVE-2025-6425: The WebCompat WebExtension shipped with Firefox exposed a persistent UUID\n- CVE-2025-6426: No warning when opening executable terminal files on macOS\n- CVE-2025-6429: Incorrect parsing of URLs could have allowed embedding of youtube.com\n- CVE-2025-6430: Content-Disposition header ignored when a file is included in an embed or object tag\n","status":"published","published":"2025-06-26T08:51:11Z","modified":"2026-03-23T04:46:27.476879Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:02339-1","title":"Security update for MozillaFirefox, MozillaFirefox-branding-SLE","description":"This update for MozillaFirefox, MozillaFirefox-branding-SLE fixes the following issues:\n\nThis is the Firefox Extended Support Release 140.0esr ESR\n\nMajor changes:\n\nGeneral:\n\n  - Reader View now has an enhanced Text and Layout menu with\n    new options for character spacing, word spacing, and text\n    alignment. These changes offer a more accessible reading\n    experience.\n  - Reader View now has a Theme menu with additional Contrast\n    and Gray options. You can also select custom colors for text,\n    background, and links from the Custom tab.\n  - Firefox will now offer to temporarily remember when users\n    grant permissions to sites (e.g. geolocation). Temporary\n    permissions will be removed either after one hour or when the\n    tab is closed.\n  - Firefox now includes safeguards to prevent sites from\n    abusing the history API by generating excessive history\n    entries, which can make navigating with the back and forward\n    buttons difficult by cluttering the history. This\n    intervention ensures that such entries, unless interacted\n    with by the user, are skipped when using the back and forward\n    buttons.\n  - Firefox now identifies all links in PDFs and turns them\n    into hyperlinks.\n  - You can now copy links from background tabs using the\n    tabstrip context menu on macOS and Linux.\n  - Users on macOS and Linux are now given the option to close\n    only the current tab if the Quit keyboard shortcut is used\n    while multiple tabs are open in the window. (bmo#None)\n\nSidebar and Tabs:\n\n - You can now enable the updated Firefox sidebar in Settings\n    \u003e General \u003e Browser Layout to quickly access multiple tools\n    in one click, without leaving your main view. Sidebar tools\n    include an AI chatbot of your choice, bookmarks, history, and\n    tabs from devices you sync with your Mozilla account.\n  - Keep a lot of tabs open? Try our new vertical tabs layout\n    to quickly scan your list of tabs. With vertical tabs, your\n    open and pinned tabs appear in the sidebar instead of along\n    the top of the browser. To turn on vertical tabs, right-click\n    on the toolbar near the top of the browser and select Turn on\n    Vertical Tabs. If you’ve enabled the updated sidebar, you can\n    also go to Customize sidebar and check Vertical tabs. Early\n    testers report feeling more organized after using vertical\n    tabs for a few days.\n  - Stay productive and organized with less effort by grouping\n    related tabs together. One simple way to create a group is to\n    drag a tab onto another, pause until you see a highlight,\n    then drop to create the group. Tab groups can be named,\n    color-coded, and are always saved. You can close a group and\n    reopen it later.\n  - A tab preview is now displayed when hovering the mouse over\n    background tabs, making it easier to locate the desired tab\n    without needing to switch tabs.\n  - The sidebar to view tabs from other devices can now be\n    opened via the Tab overview menu.\n\nSecurity \u0026 Privacy:\n\n  - HTTPS is replacing HTTP as the default protocol in the\n    address bar on non-local sites. If a site is not available\n    via HTTPS, Firefox will fall back to HTTP.\n  - Firefox now blocks third-party cookie access when Enhanced\n    Tracking Protection's Strict mode is enabled.\n  - Firefox now has a new anti-tracking feature, Bounce\n    Tracking Protection, which is now available in Enhanced\n    Tracking Protection's 'Strict' mode. This feature detects\n    bounce trackers based on their redirect behavior and\n    periodically purges their cookies and site data to block\n    tracking.\n  - Firefox now enforces certificate transparency, requiring\n    web servers to provide sufficient proof that their\n    certificates were publicly disclosed before they will be\n    trusted. This only affects servers using certificates issued\n    by a certificate authority in Mozilla's Root CA Program.\n  - Smartblock Embeds allows users to selectively unblock\n    certain social media embeds that are blocked in ETP Strict\n    and Private Browsing modes. Currently, support is limited to\n    a few embed types, with more to be added in future updates.\n  - Firefox now upgrades page loads to HTTPS by default and\n    gracefully falls back to HTTP if the secure connection fails.\n    This behavior is known as HTTPS-First.\n  - The 'Copy Without Site Tracking' menu item was renamed to\n    'Copy Clean Link' to help clarify expectations around what\n    the feature does. 'Copy Clean Link' is a list based approach\n    to remove - known tracking parameters from links. This option\n    can also now be used on plain text links.\n  - The Clear browsing data and cookies dialog now allows\n    clearing saved form info separately from browsing history.\n\nTranslations:\n\n  - Firefox now allows translating selected text portions to\n    different languages after a full-page translation.\n  - Full-Page Translations are now available within Firefox\n    extension pages that start with the moz-extension:// URL\n    scheme.\n  - When suggesting a default translation language, Firefox\n    will now take into consideration languages you have\n    previously used for translations.\n  - Added support for many new languages in Firefox\n    translation.\n\nWindows:\n\n  - Canvas2D switched from Direct2D to a platform independent\n    acceleration backend on Windows.\n  - Hardware-accelerated playback of HEVC video content is now\n    supported on Windows.\n  - Firefox on Windows 11 now uses acrylic-style menus for\n    popup windows, which better match the operating system’s\n    aesthetic. (bmo#None)\n\nLinux:\n\n  - Firefox now supports touchpad hold gestures on Linux. This\n    means that kinetic (momentum) scrolling can now be\n    interrupted by placing two fingers on the touchpad.\n    (bmo#None)\n\n* Developer:\n\n  - Firefox now supports text fragments, which\n    allows users to link directly to a specific portion of text\n    in a web document via a special URL fragment.\n  - Debugger log-point values are now automatically converted\n    into profiler markers, making it easy to add information to\n    the marker timeline directly from the Debugger.\n  - The Debugger's directory root is now scoped to the specific\n    domain where it was set, which aligns with typical usage and\n    avoids applying it across unrelated domains. This builds on\n    previous improvements such as a redesigned UI and easier\n    removal of the root setting. Setting a directory root updates\n    the Source List to show only the selected directory and its\n    children. (Learn more)\n  - The Network Blocking feature in the Network panel now\n    blocks HTTP requests in addition to blocking responses.\n    - The Network panel displays information about Early Hints,\n    including a dedicated indicator for the 103 HTTP status code\n    in the user interface.\n  - The Network panel now allows overriding network request\n    responses with local files.\n  - The filter setting in the Network panel is now preserved\n    across DevTools Toolbox sessions.\n  - A new column has been added to the Network panel to display\n    the full path of the request URL. This enhancement makes\n    helps developers quickly view and analyze complete request\n    paths.\n  - Introduced a new console command `$$$` that allows\n    searching the page, including within shadow roots.\n  - Improved support for debugging web extensions, such as\n    automatically reloading the web extension's source code in\n    the Debugger when the extension is reloaded. Workers are now\n    available in the Console panel’s context selector and\n    breakpoints function correctly in content scripts.\n  - In the Inspector Fonts panel, we now display fonts\n    metadata, like the font version, designer, vendor, license,\n    etc.\n  - Added support for the import map integrity field, allowing\n    you to ensure the integrity of dynamically or statically\n    imported modules.\n  - Implemented support for `Error.isError`, enabling brand\n    checks to determine whether an object is an instance of\n    Error. (Learn more)\n  - Added support for the `error.captureStackTrace` extension\n    to improve compatibility with other browsers. (Learn more)\n      [5]: http://github.com/tc39/proposal-error-\n    capturestacktrace (bmo#None)\n\n  * Enterprise:\n\n  - The UserMessaging policy has been updated with\n    a new option to allow disabling Firefox Labs in preferences.\n  - The Preferences policy has been updated to allow setting\n    the preference security.pki.certificate_transparency.mode.\n  - HTTPS-First is now on by default. You can manage this\n    behavior using the HttpsOnlyMode and HttpAllowlist policies.\n  - An internal change has been made to Firefox that removes\n    `XPCOMUtils.defineLazyGetter`. For most people, this\n    shouldn't matter, but if you encounter problems with\n    AutoConfig or third party software like PolicyPak, this might\n    be the cause. You'll need to reach out to your provider.\n  - Firefox now supports the Content Analysis SDK for\n    integrating DLP software. For more information, see this\n    post.\n  - The SearchEngines policy is now available on all versions\n    of Firefox (not just the ESR).\n\n* Fixed: Various security fixes.\n\n  MFSA 2025-51 (bsc#1244670)\n  * CVE-2025-6424 (bmo#1966423)\n    Use-after-free in FontFaceSet\n  * CVE-2025-6425 (bmo#1717672)\n    The WebCompat WebExtension shipped with Firefox exposed a\n    persistent UUID\n  * CVE-2025-6426 (bmo#1964385)\n    No warning when opening executable terminal files on macOS\n  * CVE-2025-6427 (bmo#1966927)\n    connect-src Content Security Policy restriction could be\n    bypassed\n  * CVE-2025-6428 (bmo#1970151)\n    Firefox for Android opened URLs specified in a link\n    querystring parameter\n  * CVE-2025-6429 (bmo#1970658)\n    Incorrect parsing of URLs could have allowed embedding of\n    youtube.com\n  * CVE-2025-6430 (bmo#1971140)\n    Content-Disposition header ignored when a file is included in\n    an embed or object tag\n  * CVE-2025-6431 (bmo#1942716)\n    The prompt in Firefox for Android that asks before opening a\n    link in an external application could be bypassed\n  * CVE-2025-6432 (bmo#1943804)\n    DNS Requests leaked outside of a configured SOCKS proxy\n  * CVE-2025-6433 (bmo#1954033)\n    WebAuthn would allow a user to sign a challenge on a webpage\n    with an invalid TLS certificate\n  * CVE-2025-6434 (bmo#1955182)\n    HTTPS-Only exception screen lacked anti-clickjacking delay\n  * CVE-2025-6435 (bmo#1950056, bmo#1961777)\n    Save as in Devtools could download files without sanitizing\n    the extension\n  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,\n    bmo#1966505, bmo#1970764)\n    Memory safety bugs fixed in Firefox 140 and Thunderbird 140\n","status":"published","published":"2025-07-17T08:52:26Z","modified":"2026-03-23T04:48:33.724412Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:02368-1","title":"Security update for MozillaThunderbird","description":"This update for MozillaThunderbird fixes the following issues:\n\nUpdate to Mozilla Thunderbird 128.12 (MFSA 2025-55, bsc#1244670):\n\n- CVE-2025-6424: Use-after-free in FontFaceSet (bmo#1966423)\n- CVE-2025-6425: The WebCompat WebExtension shipped exposed a persistent UUID (bmo#1717672)\n- CVE-2025-6426: No warning when opening executable terminal files on macOS (bmo#1964385)\n- CVE-2025-6429: Incorrect parsing of URLs could have allowed embedding of youtube.com (bmo#1970658)\n- CVE-2025-6430: Content-Disposition header ignored when a file is included in an embed or object tag (bmo#1971140)\n","status":"published","published":"2025-07-18T12:37:54Z","modified":"2026-03-23T04:46:34.213813Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:02529-1","title":"Security update for MozillaFirefox, MozillaFirefox-branding-SLE","description":"This update for MozillaFirefox, MozillaFirefox-branding-SLE fixes the following issues:\n\nMozillaFirefox is updated to the 140ESR series.\n\nFirefox Extended Support Release 140.0esr ESR:\n\n  * General\n\n  - Reader View now has an enhanced Text and Layout menu with\n    new options for character spacing, word spacing, and text\n    alignment. These changes offer a more accessible reading\n    experience.\n  - Reader View now has a Theme menu with additional Contrast\n    and Gray options. You can also select custom colors for text,\n    background, and links from the Custom tab.\n  - Firefox will now offer to temporarily remember when users\n    grant permissions to sites (e.g. geolocation). Temporary\n    permissions will be removed either after one hour or when the\n    tab is closed.\n  - Firefox now includes safeguards to prevent sites from\n    abusing the history API by generating excessive history\n    entries, which can make navigating with the back and forward\n    buttons difficult by cluttering the history. This\n    intervention ensures that such entries, unless interacted\n    with by the user, are skipped when using the back and forward\n    buttons.\n  - Firefox now identifies all links in PDFs and turns them\n    into hyperlinks.\n  - You can now copy links from background tabs using the\n    tabstrip context menu on macOS and Linux.\n  - Users on macOS and Linux are now given the option to close\n    only the current tab if the Quit keyboard shortcut is used\n    while multiple tabs are open in the window. (bmo#None)\n\n  * Sidebar and Tabs\n\n  - You can now enable the updated Firefox sidebar in Settings\n    \u003e General \u003e Browser Layout to quickly access multiple tools\n    in one click, without leaving your main view. Sidebar tools\n    include an AI chatbot of your choice, bookmarks, history, and\n    tabs from devices you sync with your Mozilla account.\n  - Keep a lot of tabs open? Try our new vertical tabs layout\n    to quickly scan your list of tabs. With vertical tabs, your\n    open and pinned tabs appear in the sidebar instead of along\n    the top of the browser. To turn on vertical tabs, right-click\n    on the toolbar near the top of the browser and select Turn on\n    Vertical Tabs. If you’ve enabled the updated sidebar, you can\n    also go to Customize sidebar and check Vertical tabs. Early\n    testers report feeling more organized after using vertical\n    tabs for a few days.\n  - Stay productive and organized with less effort by grouping\n    related tabs together. One simple way to create a group is to\n    drag a tab onto another, pause until you see a highlight,\n    then drop to create the group. Tab groups can be named,\n    color-coded, and are always saved. You can close a group and\n    reopen it later.\n  - A tab preview is now displayed when hovering the mouse over\n    background tabs, making it easier to locate the desired tab\n    without needing to switch tabs.\n  - The sidebar to view tabs from other devices can now be\n    opened via the Tab overview menu.\n\n  * Security \u0026 Privacy\n\n  - HTTPS is replacing HTTP as the default protocol in the\n    address bar on non-local sites. If a site is not available\n    via HTTPS, Firefox will fall back to HTTP.\n  - Firefox now blocks third-party cookie access when Enhanced\n    Tracking Protection's Strict mode is enabled.\n  - Firefox now has a new anti-tracking feature, Bounce\n    Tracking Protection, which is now available in Enhanced\n    Tracking Protection's 'Strict' mode. This feature detects\n    bounce trackers based on their redirect behavior and\n    periodically purges their cookies and site data to block\n    tracking.\n  - Firefox now enforces certificate transparency, requiring\n    web servers to provide sufficient proof that their\n    certificates were publicly disclosed before they will be\n    trusted. This only affects servers using certificates issued\n    by a certificate authority in Mozilla's Root CA Program.\n  - Smartblock Embeds allows users to selectively unblock\n    certain social media embeds that are blocked in ETP Strict\n    and Private Browsing modes. Currently, support is limited to\n    a few embed types, with more to be added in future updates.\n  - Firefox now upgrades page loads to HTTPS by default and\n    gracefully falls back to HTTP if the secure connection fails.\n    This behavior is known as HTTPS-First.\n  - The 'Copy Without Site Tracking' menu item was renamed to\n    'Copy Clean Link' to help clarify expectations around what\n    the feature does. 'Copy Clean Link' is a list based approach\n    to remove - known tracking parameters from links. This option\n    can also now be used on plain text links.\n  - The Clear browsing data and cookies dialog now allows\n    clearing saved form info separately from browsing history.\n\n  * Translations\n\n  - Firefox now allows translating selected text portions to\n    different languages after a full-page translation.\n  - Full-Page Translations are now available within Firefox\n    extension pages that start with the moz-extension:// URL\n    scheme.\n  - When suggesting a default translation language, Firefox\n    will now take into consideration languages you have\n    previously used for translations.\n  - Added support for many new languages in Firefox\n    translation.\n\n  * Linux\n\n  - Firefox now supports touchpad hold gestures on Linux. This\n    means that kinetic (momentum) scrolling can now be\n    interrupted by placing two fingers on the touchpad.\n\n  * Developer:\n\n  - Firefox now supports text fragments, which\n    allows users to link directly to a specific portion of text\n    in a web document via a special URL fragment.\n  - Debugger log-point values are now automatically converted\n    into profiler markers, making it easy to add information to\n    the marker timeline directly from the Debugger.\n  - The Debugger's directory root is now scoped to the specific\n    domain where it was set, which aligns with typical usage and\n    avoids applying it across unrelated domains. This builds on\n    previous improvements such as a redesigned UI and easier\n    removal of the root setting. Setting a directory root updates\n    the Source List to show only the selected directory and its\n    children. (Learn more)\n  - The Network Blocking feature in the Network panel now\n    blocks HTTP requests in addition to blocking responses.\n  - The Network panel displays information about Early Hints,\n    including a dedicated indicator for the 103 HTTP status code\n    in the user interface.\n  - The Network panel now allows overriding network request\n    responses with local files.\n  - The filter setting in the Network panel is now preserved\n    across DevTools Toolbox sessions.\n  - A new column has been added to the Network panel to display\n    the full path of the request URL. This enhancement makes\n    helps developers quickly view and analyze complete request\n    paths.\n  - Introduced a new console command `$$$` that allows\n    searching the page, including within shadow roots.\n  - Improved support for debugging web extensions, such as\n    automatically reloading the web extension's source code in\n    the Debugger when the extension is reloaded. Workers are now\n    available in the Console panel’s context selector and\n    breakpoints function correctly in content scripts.\n  - In the Inspector Fonts panel, we now display fonts\n    metadata, like the font version, designer, vendor, license,\n    etc.\n  - Added support for the import map integrity field, allowing\n    you to ensure the integrity of dynamically or statically\n    imported modules.\n  - Implemented support for `Error.isError`, enabling brand\n    checks to determine whether an object is an instance of\n    Error. (Learn more)\n  - Added support for the `error.captureStackTrace` extension\n    to improve compatibility with other browsers. (Learn more:\n    http://github.com/tc39/proposal-error-capturestacktrace)\n\n  * Enterprise:\n\n  - The UserMessaging policy has been updated with\n    a new option to allow disabling Firefox Labs in preferences.\n  - The Preferences policy has been updated to allow setting\n    the preference security.pki.certificate_transparency.mode.\n  - HTTPS-First is now on by default. You can manage this\n    behavior using the HttpsOnlyMode and HttpAllowlist policies.\n  - An internal change has been made to Firefox that removes\n    `XPCOMUtils.defineLazyGetter`. For most people, this\n    shouldn't matter, but if you encounter problems with\n    AutoConfig or third party software like PolicyPak, this might\n    be the cause. You'll need to reach out to your provider.\n  - Firefox now supports the Content Analysis SDK for\n    integrating DLP software. For more information, see this\n    post.\n  - The SearchEngines policy is now available on all versions\n    of Firefox (not just the ESR).\n\nVarious security fixes MFSA 2025-51 (bsc#1244670):\n\n  * CVE-2025-6424 (bmo#1966423)\n    Use-after-free in FontFaceSet\n  * CVE-2025-6425 (bmo#1717672)\n    The WebCompat WebExtension shipped with Firefox exposed a\n    persistent UUID\n  * CVE-2025-6426 (bmo#1964385)\n    No warning when opening executable terminal files on macOS\n  * CVE-2025-6427 (bmo#1966927)\n    connect-src Content Security Policy restriction could be\n    bypassed\n  * CVE-2025-6428 (bmo#1970151)\n    Firefox for Android opened URLs specified in a link\n    querystring parameter\n  * CVE-2025-6429 (bmo#1970658)\n    Incorrect parsing of URLs could have allowed embedding of\n    youtube.com\n  * CVE-2025-6430 (bmo#1971140)\n    Content-Disposition header ignored when a file is included in\n    an embed or object tag\n  * CVE-2025-6431 (bmo#1942716)\n    The prompt in Firefox for Android that asks before opening a\n    link in an external application could be bypassed\n  * CVE-2025-6432 (bmo#1943804)\n    DNS Requests leaked outside of a configured SOCKS proxy\n  * CVE-2025-6433 (bmo#1954033)\n    WebAuthn would allow a user to sign a challenge on a webpage\n    with an invalid TLS certificate\n  * CVE-2025-6434 (bmo#1955182)\n    HTTPS-Only exception screen lacked anti-clickjacking delay\n  * CVE-2025-6435 (bmo#1950056, bmo#1961777)\n    Save as in Devtools could download files without sanitizing\n    the extension\n  * CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,\n    bmo#1966505, bmo#1970764)\n    Memory safety bugs fixed in Firefox 140 and Thunderbird 140\n    \nVarious security fixes MFSA 2025-59 (bsc#1246664):\n\n- CVE-2025-8027: JavaScript engine only wrote partial return value to stack\n- CVE-2025-8028: Large branch table could lead to truncated instruction\n- CVE-2025-8029: javascript: URLs executed on object and embed tags\n- CVE-2025-8036: DNS rebinding circumvents CORS\n- CVE-2025-8037: Nameless cookies shadow secure cookies\n- CVE-2025-8030: Potential user-assisted code execution in “Copy as cURL” command\n- CVE-2025-8031: Incorrect URL stripping in CSP reports\n- CVE-2025-8032: XSLT documents could bypass CSP\n- CVE-2025-8038: CSP frame-src was not correctly enforced for paths\n- CVE-2025-8039: Search terms persisted in URL bar\n- CVE-2025-8033: Incorrect JavaScript state machine for generators\n- CVE-2025-8034: Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141\n- CVE-2025-8040: Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141\n- CVE-2025-8035: Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141  \n","status":"published","published":"2025-07-25T17:35:29Z","modified":"2026-03-23T04:46:39.491759Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:02546-1","title":"Security update for MozillaThunderbird","description":"This update for MozillaThunderbird fixes the following issues:\n\nUpdate to Mozilla Thunderbird 140.1 (MFSA 2025-63) (bsc#1246664):\n\n- CVE-2025-8027: JavaScript engine only wrote partial return value to stack (bmo#1968423)\n- CVE-2025-8028: Large branch table could lead to truncated instruction (bmo#1971581)\n- CVE-2025-8029: javascript: URLs executed on object and embed tags (bmo#1928021)\n- CVE-2025-8036: DNS rebinding circumvents CORS (bmo#1960834)\n- CVE-2025-8037: Nameless cookies shadow secure cookies (bmo#1964767)\n- CVE-2025-8030: Potential user-assisted code execution in 'Copy as cURL' command (bmo#1968414)\n- CVE-2025-8031: Incorrect URL stripping in CSP reports (bmo#1971719)\n- CVE-2025-8032: XSLT documents could bypass CSP (bmo#1974407)\n- CVE-2025-8038: CSP frame-src was not correctly enforced for paths (bmo#1808979)\n- CVE-2025-8039: Search terms persisted in URL bar (bmo#1970997)\n- CVE-2025-8033: Incorrect JavaScript state machine for generators (bmo#1973990)\n- CVE-2025-8034: Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141 (bmo#1970422, bmo#1970422, bmo#1970422, bmo#1970422)\n- CVE-2025-8040: Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141 (bmo#1975058, bmo#1975058, bmo#1975998, bmo#1975998)\n- CVE-2025-8035: Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141 (bmo#1975961, bmo#1975961, bmo#1975961)\n\nUpdate to Mozilla Thunderbird 140.0.1 (MFSA 2025-54) (bsc#1244670):\n\n- CVE-2025-6424: Use-after-free in FontFaceSet (bmo#1966423)\n- CVE-2025-6425: The WebCompat WebExtension shipped exposed a persistent UUID (bmo#1717672)\n- CVE-2025-6426: No warning when opening executable terminal files on macOS (bmo#1964385)\n- CVE-2025-6427: connect-src Content Security Policy restriction could be bypassed (bmo#1966927)\n- CVE-2025-6429: Incorrect parsing of URLs could have allowed embedding of youtube.com (bmo#1970658)\n- CVE-2025-6430: Content-Disposition header ignored when a file is included in an embed or object tag (bmo#1971140)\n- CVE-2025-6432: DNS Requests leaked outside of a configured SOCKS proxy (bmo#1943804)\n- CVE-2025-6433: WebAuthn would allow a user to sign a challenge on a webpage with an invalid TLS certificate (bmo#1954033)\n- CVE-2025-6434: HTTPS-Only exception screen lacked anti-clickjacking delay (bmo#1955182)\n- CVE-2025-6435: Save as in Devtools could download files without sanitizing the extension (bmo#1950056, bmo#1961777)\n- CVE-2025-6436: Memory safety bugs fixed in Firefox 140 and Thunderbird 140 (bmo#1941377, bmo#1960948, bmo#1966187, bmo#1966505, bmo#1970764)\n","status":"published","published":"2025-07-30T07:34:22Z","modified":"2026-02-04T03:26:56.239873Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:21170-1","title":"Security update for mozjs128","description":"This update for mozjs128 fixes the following issues:\n\n- Update to version 128.14.0 (bsc#1248162):\n  + CVE-2025-9179: Sandbox escape due to invalid pointer in the\n    Audio/Video: GMP component\n  + CVE-2025-9180: Same-origin policy bypass in the Graphics:\n    Canvas2D component\n  + CVE-2025-9181: Uninitialized memory in the JavaScript Engine\n    component\n  + CVE-2025-9185: Memory safety bugs fixed in Firefox ESR 115.27,\n    Firefox ESR 128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,\n    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142\n\n- Update to version 128.13.0:\n  + CVE-2025-8027: JavaScript engine only wrote partial return\n    value to stack\n  + CVE-2025-8028: Large branch table could lead to truncated\n    instruction\n  + CVE-2025-8029: javascript: URLs executed on object and embed\n    tags\n  + CVE-2025-8030: Potential user-assisted code execution in “Copy\n    as cURL” command\n  + CVE-2025-8031: Incorrect URL stripping in CSP reports\n  + CVE-2025-8032: XSLT documents could bypass CSP\n  + CVE-2025-8033: Incorrect JavaScript state machine for\n    generators\n  + CVE-2025-8034: Memory safety bugs fixed in Firefox ESR 115.26,\n    Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,\n    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141\n  + CVE-2025-8035: Memory safety bugs fixed in Firefox ESR 128.13,\n    Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR\n    140.1, Firefox 141 and Thunderbird 141\n\n- Update to version 128.12.0:\n  + CVE-2025-6424: Use-after-free in FontFaceSet\n  + CVE-2025-6425: The WebCompat WebExtension shipped with Firefox\n    exposed a persistent UUID\n  + CVE-2025-6426: No warning when opening executable terminal\n    files on macOS\n  + CVE-2025-6429: Incorrect parsing of URLs could have allowed\n    embedding of youtube.com\n  + CVE-2025-6430: Content-Disposition header ignored when a file\n    is included in an embed or object tag\n\n- Update to version 128.11.0:\n  + CVE-2025-5283: Double-free in libvpx encoder\n  + CVE-2025-5263: Error handling for script execution was\n    incorrectly isolated from web content\n  + CVE-2025-5264: Potential local code execution in “Copy as cURL”\n    command\n  + CVE-2025-5265: Potential local code execution in “Copy as cURL”\n    command\n  + CVE-2025-5266: Script element events leaked cross-origin\n    resource status\n  + CVE-2025-5267: Clickjacking vulnerability could have led to\n    leaking saved payment card details\n  + CVE-2025-5268: Memory safety bugs fixed in Firefox 139,\n    Thunderbird 139, Firefox ESR 128.11, and Thunderbird 128.11\n  + CVE-2025-5269: Memory safety bug fixed in Firefox ESR 128.11\n    and Thunderbird 128.11\n","status":"published","published":"2025-12-03T20:38:36Z","modified":"2026-03-23T04:49:17.541487Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"USN-7663-1","title":"thunderbird vulnerabilities","description":"Multiple security issues were discovered in Thunderbird. If a user were\ntricked into opening a specially crafted website in a browsing context, an\nattacker could potentially exploit these to cause a denial of service,\nobtain sensitive information, bypass security restrictions, cross-site\ntracing, or execute arbitrary code.","status":"published","published":"2025-07-22T11:55:19Z","modified":"2026-04-27T18:17:10.776219067Z","updated_at":"2026-11-02T16:58:21.91885Z"}]}}