Cleartext transmission of sensitive information in Firefox for Android and Mozilla Firefox - CVE-2025-5270
Published: May 27, 2025
Vulnerability identifier: #VU109879
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-5270
CWE-ID: CWE-319
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to software does not always encrypt SNI even when encrypted DNS was enabled. A remote attacker with ability to intercept network traffic can gain access to sensitive data.
Affected software
Firefox for Android
Mozilla Firefox
Ubuntu
Mozilla Thunderbird
thunderbird (Ubuntu package)
Mozilla Firefox
Ubuntu
Mozilla Thunderbird
thunderbird (Ubuntu package)
How to mitigate CVE-2025-5270
Install updates from vendor's website.
Firefox for Android - update to 139.0
Mozilla Firefox - update to 139.0
Mozilla Thunderbird - update to 139.0
thunderbird (Ubuntu package) - update to 1:140.7.1+build1-0ubuntu0.22.04.1
Mozilla Firefox - update to 139.0
Mozilla Thunderbird - update to 139.0
thunderbird (Ubuntu package) - update to 1:140.7.1+build1-0ubuntu0.22.04.1