CVE-2025-3523
📋 TL;DR
This vulnerability in Thunderbird email client causes misleading hover text when emails contain multiple attachments with external links. Only the last link appears when hovering over any attachment, potentially tricking users into downloading malicious content. Affects Thunderbird users on vulnerable versions.
💻 Affected Systems
- Mozilla Thunderbird
📦 What is this software?
Thunderbird by Mozilla
Thunderbird by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
User downloads and executes malware from untrusted source, leading to system compromise, data theft, or ransomware infection.
Likely Case
User downloads malicious file thinking it's from trusted source, potentially leading to malware infection or phishing credential theft.
If Mitigated
User notices discrepancy or has security controls preventing execution, limiting impact to failed download attempt.
🎯 Exploit Status
Exploitation requires user to open malicious email and interact with attachment hover text.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Thunderbird 137.0.2 or Thunderbird 128.9.2
Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2025-26/
Restart Required: Yes
Instructions:
1. Open Thunderbird. 2. Go to Help > About Thunderbird. 3. Allow automatic update or download latest version from mozilla.org. 4. Restart Thunderbird after update.
🔧 Temporary Workarounds
Disable external attachment links
allConfigure Thunderbird to block external attachment URLs via X-Mozilla-External-Attachment-URL header
Disable link preview on hover
allDisable tooltips or hover preview functionality in Thunderbird settings
🧯 If You Can't Patch
- Train users to verify URLs before clicking by checking status bar or link properties
- Implement email filtering to block messages with X-Mozilla-External-Attachment-URL headers
🔍 How to Verify
Check if Vulnerable:
Check Thunderbird version in Help > About Thunderbird. If version is below 137.0.2 (ESR 128 below 128.9.2), system is vulnerable.Check Version:
thunderbird --versionVerify Fix Applied:
After update, verify version shows 137.0.2 or higher (or 128.9.2+ for ESR). Test with safe email containing multiple external attachment links.📡 Detection & Monitoring
Log Indicators:
- Multiple X-Mozilla-External-Attachment-URL headers in email logs
- User reports of misleading link hover text
Network Indicators:
- Email traffic with multiple external attachment URLs
SIEM Query:
source="thunderbird" AND "X-Mozilla-External-Attachment-URL" count>1