Spoofing attack in Mozilla Thunderbird - CVE-2025-3523
Published: April 15, 2025
Vulnerability identifier: #VU107465
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:U/U:Clear
CVE-ID: CVE-2025-3523
CWE-ID: CWE-451
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Mozilla
Affected software:
Mozilla Thunderbird
Mozilla Thunderbird
Detailed vulnerability description
The vulnerability allows a remote attacker to perform spoofing attack.
When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header, only the last link is shown when hovering over any attachment. Although the correct link is used on click, the misleading hover text could trick users into downloading content from untrusted sources.
How to mitigate CVE-2025-3523
Install updates from vendor's website.