CVE-2025-1013
📋 TL;DR
A race condition vulnerability in Mozilla Firefox, Firefox ESR, and Thunderbird could cause private browsing tabs to open in normal browsing windows, potentially leaking private browsing data. This affects users running vulnerable versions of these applications. The vulnerability could expose browsing history, cookies, and other private data.
💻 Affected Systems
- Mozilla Firefox
- Mozilla Firefox ESR
- Mozilla Thunderbird
📦 What is this software?
Firefox by Mozilla
Firefox by Mozilla
Thunderbird by Mozilla
Thunderbird by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
Private browsing session data (history, cookies, form data) becomes accessible in normal browsing windows, potentially exposing sensitive user information to other users or attackers with access to the system.
Likely Case
Intermittent privacy leaks where private browsing data briefly appears in normal windows, potentially exposing browsing history or session data.
If Mitigated
Minimal impact if users don't use private browsing or if proper browser isolation practices are followed.
🎯 Exploit Status
Exploitation requires race condition timing and user interaction with private browsing mode. No public exploits have been reported.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firefox 135+, Firefox ESR 128.7+, Thunderbird 128.7+, Thunderbird 135+
Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2025-07/
Restart Required: Yes
Instructions:
1. Open the affected application (Firefox or Thunderbird). 2. Click the menu button (three horizontal lines). 3. Select Help > About Firefox/Thunderbird. 4. The application will check for updates and install if available. 5. Restart the application when prompted.
🔧 Temporary Workarounds
Disable Private Browsing
allPrevent use of private browsing mode to eliminate the vulnerability surface.
Not applicable - configuration change in browser settings
Use Separate Browser Profiles
allCreate separate browser profiles for private browsing to isolate sessions.
firefox -CreateProfile "PrivateProfile"
thunderbird -CreateProfile "PrivateProfile"
🧯 If You Can't Patch
- Avoid using private browsing mode on vulnerable versions
- Clear browser history and cookies regularly to minimize potential data exposure
🔍 How to Verify
Check if Vulnerable:
Check the application version in Help > About Firefox/Thunderbird and compare with affected versions.Check Version:
firefox --version (Linux/macOS) or check About dialog (Windows)Verify Fix Applied:
Verify the application version is Firefox 135+, Firefox ESR 128.7+, Thunderbird 128.7+, or Thunderbird 135+.📡 Detection & Monitoring
Log Indicators:
- Browser logs showing unexpected window/tab creation events
- Private browsing session logs appearing in normal session logs
Network Indicators:
- None - this is a local client-side vulnerability
SIEM Query:
Not applicable for client-side privacy vulnerability🔗 References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1932555
- https://www.mozilla.org/security/advisories/mfsa2025-07/
- https://www.mozilla.org/security/advisories/mfsa2025-09/
- https://www.mozilla.org/security/advisories/mfsa2025-10/
- https://www.mozilla.org/security/advisories/mfsa2025-11/
- https://lists.debian.org/debian-lts-announce/2025/02/msg00006.html
