CVE-2025-6432
📋 TL;DR
This vulnerability allows DNS requests to bypass SOCKS proxy configurations when Multi-Account Containers is enabled and either the domain name is invalid or the SOCKS proxy is unresponsive. This affects Firefox versions below 140 and Thunderbird versions below 140, potentially exposing users' DNS queries to unintended networks.
💻 Affected Systems
- Mozilla Firefox
- Mozilla Thunderbird
📦 What is this software?
Firefox by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
DNS queries leak to the internet, revealing internal hostnames, visited domains, and potentially sensitive metadata to attackers who can intercept network traffic.
Likely Case
DNS requests bypass organizational proxy controls, potentially exposing browsing patterns and internal network information when users encounter invalid domains or proxy issues.
If Mitigated
Limited exposure with minimal sensitive data leakage if proper network segmentation and monitoring are in place.
🎯 Exploit Status
Exploitation requires user interaction (browsing) and specific proxy configuration conditions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firefox 140, Thunderbird 140
Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2025-51/
Restart Required: Yes
Instructions:
1. Open Firefox/Thunderbird. 2. Go to Help > About Firefox/Thunderbird. 3. Allow automatic update to version 140 or higher. 4. Restart the application.
🔧 Temporary Workarounds
Disable Multi-Account Containers
allTemporarily disable the Multi-Account Containers feature to prevent the bypass.
about:config
Set 'privacy.userContext.enabled' to false
Use alternative proxy configuration
allConfigure proxy settings at system level instead of within Firefox/Thunderbird.
🧯 If You Can't Patch
- Implement network monitoring for DNS queries bypassing proxy
- Restrict use of Multi-Account Containers feature in vulnerable versions
🔍 How to Verify
Check if Vulnerable:
Check Firefox/Thunderbird version in Help > About. If version is below 140 and Multi-Account Containers is enabled with SOCKS proxy, system is vulnerable.Check Version:
firefox --version (Linux) or check About dialogVerify Fix Applied:
Confirm version is 140 or higher in Help > About and test DNS resolution through proxy.📡 Detection & Monitoring
Log Indicators:
- DNS queries from Firefox/Thunderbird bypassing proxy logs
- Failed proxy connection attempts followed by direct DNS resolution
Network Indicators:
- DNS traffic from Firefox/Thunderbird clients not routed through expected SOCKS proxy
- Unexpected DNS queries to public resolvers
SIEM Query:
source="firefox" OR source="thunderbird" AND (event="dns_query" AND NOT proxy_ip="expected_proxy")