CVE-2025-1015
📋 TL;DR
This vulnerability allows attackers to embed malicious links in Thunderbird address book fields. When another user imports the infected address book and clicks the link, JavaScript executes within Thunderbird's browser context. This affects Thunderbird users running versions below 128.7 or 135.
💻 Affected Systems
- Mozilla Thunderbird
📦 What is this software?
Thunderbird by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
Attackers could execute arbitrary JavaScript in Thunderbird's context, potentially stealing session cookies, redirecting to phishing sites, or performing client-side attacks against the user.
Likely Case
Attackers create address books with malicious links that execute JavaScript when imported and clicked, enabling social engineering attacks or information theft.
If Mitigated
With proper patching and user awareness, impact is minimal as JavaScript execution is unprivileged and requires user interaction.
🎯 Exploit Status
Exploitation requires social engineering to convince users to import malicious address books and click links.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Thunderbird 128.7 or Thunderbird 135
Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2025-10/
Restart Required: Yes
Instructions:
1. Open Thunderbird. 2. Go to Help > About Thunderbird. 3. Allow automatic update or download latest version from mozilla.org. 4. Restart Thunderbird after update.
🔧 Temporary Workarounds
Disable JavaScript in Thunderbird
allPrevents JavaScript execution from malicious links
Edit config: Set javascript.enabled to false in about:config
Restrict Address Book Imports
allLimit address book imports to trusted sources only
🧯 If You Can't Patch
- Avoid importing address books from untrusted sources
- Train users to never click links in imported address books without verification
🔍 How to Verify
Check if Vulnerable:
Check Thunderbird version in Help > About ThunderbirdCheck Version:
thunderbird --version (Linux) or check About dialogVerify Fix Applied:
Confirm version is Thunderbird 128.7 or higher, or Thunderbird 135 or higher📡 Detection & Monitoring
Log Indicators:
- Unusual address book import activity
- Multiple failed import attempts
Network Indicators:
- Connections to suspicious domains from Thunderbird process
SIEM Query:
process:thunderbird AND (event:import OR url:*malicious* OR user_agent:thunderbird)