CVE-2025-6435
📋 TL;DR
This vulnerability in Firefox and Thunderbird allows saved files from the Network tab in Devtools to lack the .download extension, potentially causing users to inadvertently execute malicious files. Attackers could exploit this by tricking users into saving and running disguised executables. This affects Firefox versions before 140 and Thunderbird versions before 140.
💻 Affected Systems
- Mozilla Firefox
- Mozilla Thunderbird
📦 What is this software?
Firefox by Mozilla
Thunderbird by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
User executes a malicious executable disguised as a benign file, leading to full system compromise, data theft, or ransomware deployment.
Likely Case
User accidentally runs a malicious file thinking it's a saved response, resulting in malware infection or credential theft.
If Mitigated
User notices the missing .download extension or has security software that blocks suspicious executables, preventing execution.
🎯 Exploit Status
Exploitation requires social engineering to trick users into saving and executing malicious files.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firefox 140, Thunderbird 140
Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2025-51/
Restart Required: Yes
Instructions:
1. Open Firefox/Thunderbird. 2. Go to Help > About Firefox/Thunderbird. 3. Allow automatic update to version 140 or higher. 4. Restart the application.
🔧 Temporary Workarounds
Disable Devtools Save As
allPrevent users from saving files via Devtools Network tab.
Not applicable - requires policy/configuration management
User Education
allTrain users to verify file extensions before opening saved files.
🧯 If You Can't Patch
- Disable Devtools access for users via enterprise policies.
- Implement application whitelisting to block unauthorized executables.
🔍 How to Verify
Check if Vulnerable:
Check Firefox/Thunderbird version: if below 140, vulnerable.Check Version:
firefox --version or thunderbird --versionVerify Fix Applied:
Confirm version is 140 or higher after update.📡 Detection & Monitoring
Log Indicators:
- Unusual file saves from browser processes without .download extension
- Execution of files saved from browser without proper extension
Network Indicators:
- Downloads from suspicious sources saved without expected extensions
SIEM Query:
process_name:firefox.exe AND file_operation:save AND NOT file_extension:.download