Information disclosure in Firefox for Android and Mozilla Firefox - CVE-2025-1942

Vulnerability identifier: #VU105324

CSH Severity: Low

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2025-1942

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

Affected software:
Firefox for Android
Mozilla Firefox
Gentoo Linux
Ubuntu
Fedora
Mozilla Thunderbird
www-client/firefox
www-client/firefox-bin
firefox (Ubuntu package)
firefox
thunderbird (Ubuntu package)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application within the String.toUpperCase() function, which includes parts of uninitialized memory into the result output. A remote attacker can gain unauthorized access to sensitive information.

Install updates from vendor's website.

• https://www.mozilla.org/en-US/security/advisories/mfsa2025-14/
• https://bugzilla.mozilla.org/show_bug.cgi?id=1947139