CVE-2025-6426
📋 TL;DR
This vulnerability in Firefox for macOS fails to warn users before opening files with the 'terminal' extension, bypassing security warnings. It affects Firefox < 140, Firefox ESR < 128.12, Thunderbird < 140, and Thunderbird ESR < 128.12 on macOS systems only.
💻 Affected Systems
- Firefox
- Firefox ESR
- Thunderbird
- Thunderbird ESR
📦 What is this software?
Firefox by Mozilla
Firefox by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
Attackers could execute malicious terminal scripts without user warning, leading to full system compromise via arbitrary code execution.
Likely Case
Users inadvertently execute malicious terminal scripts thinking they're safe files, leading to malware installation or data theft.
If Mitigated
With proper user awareness and endpoint protection, impact is limited to isolated incidents requiring user interaction.
🎯 Exploit Status
Exploitation requires user interaction to download and execute malicious .terminal files. No authentication bypass needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firefox 140+, Firefox ESR 128.12+, Thunderbird 140+, Thunderbird ESR 128.12+
Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2025-51/
Restart Required: Yes
Instructions:
1. Open Firefox/Thunderbird. 2. Click Help > About Firefox/Thunderbird. 3. Allow automatic update to complete. 4. Restart the application when prompted.
🔧 Temporary Workarounds
Disable automatic file opening
macOSConfigure Firefox to ask before opening downloaded files
1. Open Firefox. 2. Go to Preferences > General. 3. Under Downloads, check 'Always ask you where to save files'
Use alternative browser temporarily
allSwitch to non-vulnerable browser until patched
🧯 If You Can't Patch
- Disable automatic opening of downloaded files in Firefox preferences
- Implement application control to block execution of .terminal files from browsers
🔍 How to Verify
Check if Vulnerable:
Check Firefox/Thunderbird version: Help > About Firefox/Thunderbird. If version is below patched versions and on macOS, system is vulnerable.Check Version:
firefox --version or thunderbird --versionVerify Fix Applied:
Verify version is Firefox 140+, Firefox ESR 128.12+, Thunderbird 140+, or Thunderbird ESR 128.12+. Test by downloading a .terminal file - should now show warning.📡 Detection & Monitoring
Log Indicators:
- Unexpected execution of .terminal files from browser downloads
- Firefox/Thunderbird processes spawning terminal processes
Network Indicators:
- Downloads of .terminal files from untrusted sources
SIEM Query:
process.name:firefox AND process.child.name:terminal OR process.name:thunderbird AND process.child.name:terminal