Protection Mechanism Failure in Firefox for Android and Mozilla Firefox - CVE-2025-6434

Vulnerability identifier: #VU111895

CSH Severity: Low

CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-6434

CWE-ID: CWE-693

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to the exception page for the HTTPS-Only feature, displayed when a website is opened via HTTP, lacked an anti-clickjacking delay, potentially allowing an attacker to trick a user into granting an exception and loading a webpage over HTTP.

Firefox for Android
Mozilla Firefox
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP3
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Workstation Extension 15
SUSE Enterprise Storage
SUSE Package Hub 15
Desktop Applications Module
openSUSE Leap
Ubuntu
Fedora
Mozilla Thunderbird
pipewire-libpulse-0_3-debuginfo
pipewire-libpulse-0_3
pipewire-debuginfo
pipewire-debugsource
pipewire-libjack-0_3-32bit-debuginfo
pipewire-tools-debuginfo
pipewire-alsa
pipewire-libjack-0_3-debuginfo
pipewire-spa-plugins-0_2-32bit-debuginfo
libpipewire-0_3-0
libpipewire-0_3-0-32bit
pipewire-modules-32bit-debuginfo
pipewire-spa-plugins-0_2-debuginfo
pipewire
libpipewire-0_3-0-32bit-debuginfo
pipewire-modules-32bit
pipewire-spa-tools
pipewire-libjack-0_3-32bit
pipewire-alsa-debuginfo
pipewire-pulseaudio-debuginfo
pipewire-spa-plugins-0_2-32bit
pipewire-devel
pipewire-spa-tools-debuginfo
pipewire-modules-debuginfo
pipewire-doc
pipewire-tools
pipewire-libjack-0_3-64bit
gstreamer-plugin-pipewire
libpipewire-0_3-0-debuginfo
libpipewire-0_3-0-64bit
pipewire-modules-64bit-debuginfo
pipewire-pulseaudio
libpipewire-0_3-0-64bit-debuginfo
pipewire-libjack-0_3
pipewire-modules-64bit
pipewire-libjack-0_3-64bit-debuginfo
pipewire-spa-plugins-0_2
pipewire-lang
pipewire-spa-plugins-0_2-64bit-debuginfo
pipewire-spa-plugins-0_2-64bit
pipewire-modules
gstreamer-plugin-pipewire-debuginfo
pipewire-modules-0_3
pipewire-libjack-0_3-devel
pipewire-modules-0_3-debuginfo
pipewire-alsa-32bit-debuginfo
pipewire-modules-0_3-64bit
pipewire-alsa-64bit
pipewire-alsa-64bit-debuginfo
pipewire-modules-0_3-64bit-debuginfo
pipewire-alsa-32bit
pipewire-modules-0_3-32bit
pipewire-modules-0_3-32bit-debuginfo
pipewire-module-x11-0_3-debuginfo
pipewire-module-x11-0_3
xdg-desktop-portal
xdg-desktop-portal-devel
xdg-desktop-portal-debugsource
xdg-desktop-portal-lang
xdg-desktop-portal-debuginfo
firefox
MozillaThunderbird
MozillaThunderbird-translations-common
MozillaThunderbird-translations-other
MozillaThunderbird-debugsource
MozillaThunderbird-debuginfo
MozillaFirefox-debuginfo
MozillaFirefox-branding-upstream
MozillaFirefox-translations-other
MozillaFirefox
MozillaFirefox-devel
MozillaFirefox-debugsource
MozillaFirefox-translations-common
thunderbird (Ubuntu package)
MozillaFirefox-branding-SLE

Install updates from vendor's website.

Firefox for Android - update to 140.0
Mozilla Firefox - update to 140.0
Mozilla Thunderbird - update to 140.0
pipewire-libpulse-0_3-debuginfo - update to 0.3.6-150200.3.11.1
pipewire-libpulse-0_3 - update to 0.3.6-150200.3.11.1
pipewire-debuginfo - addressed in versions 0.3.6-150200.3.11.1, 0.3.24-150300.4.8.1, 0.3.49-150400.3.7.1, 0.3.64-150500.3.7.2
pipewire-debugsource - addressed in versions 0.3.6-150200.3.11.1, 0.3.24-150300.4.8.1, 0.3.49-150400.3.7.1, 0.3.64-150500.3.7.2
pipewire-libjack-0_3-32bit-debuginfo - addressed in versions 0.3.24-150300.4.8.1, 0.3.49-150400.3.7.1, 0.3.64-150500.3.7.2
pipewire-tools-debuginfo - addressed in versions 0.3.24-150300.4.8.1, 0.3.49-150400.3.7.1, 0.3.64-150500.3.7.2
pipewire-alsa - addressed in versions 0.3.24-150300.4.8.1, 0.3.49-150400.3.7.1, 0.3.64-150500.3.7.2
pipewire-libjack-0_3-debuginfo - addressed in versions 0.3.24-150300.4.8.1, 0.3.49-150400.3.7.1, 0.3.64-150500.3.7.2
pipewire-spa-plugins-0_2-32bit-debuginfo - addressed in versions 0.3.24-150300.4.8.1, 0.3.49-150400.3.7.1, 0.3.64-150500.3.7.2
libpipewire-0_3-0 - addressed in versions 0.3.24-150300.4.8.1, 0.3.49-150400.3.7.1, 0.3.64-150500.3.7.2
libpipewire-0_3-0-32bit - addressed in versions 0.3.24-150300.4.8.1, 0.3.49-150400.3.7.1, 0.3.64-150500.3.7.2
pipewire-modules-32bit-debuginfo - update to 0.3.24-150300.4.8.1
pipewire-spa-plugins-0_2-debuginfo - addressed in versions 0.3.24-150300.4.8.1, 0.3.49-150400.3.7.1, 0.3.64-150500.3.7.2
pipewire - addressed in versions 0.3.24-150300.4.8.1, 0.3.49-150400.3.7.1, 0.3.64-150500.3.7.2
libpipewire-0_3-0-32bit-debuginfo - addressed in versions 0.3.24-150300.4.8.1, 0.3.49-150400.3.7.1, 0.3.64-150500.3.7.2
pipewire-modules-32bit - update to 0.3.24-150300.4.8.1
pipewire-spa-tools - addressed in versions 0.3.24-150300.4.8.1, 0.3.49-150400.3.7.1, 0.3.64-150500.3.7.2
pipewire-libjack-0_3-32bit - addressed in versions 0.3.24-150300.4.8.1, 0.3.49-150400.3.7.1, 0.3.64-150500.3.7.2
pipewire-alsa-debuginfo - addressed in versions 0.3.24-150300.4.8.1, 0.3.49-150400.3.7.1, 0.3.64-150500.3.7.2
pipewire-pulseaudio-debuginfo - addressed in versions 0.3.24-150300.4.8.1, 0.3.49-150400.3.7.1, 0.3.64-150500.3.7.2
pipewire-spa-plugins-0_2-32bit - addressed in versions 0.3.24-150300.4.8.1, 0.3.49-150400.3.7.1, 0.3.64-150500.3.7.2
pipewire-devel - addressed in versions 0.3.24-150300.4.8.1, 0.3.49-150400.3.7.1, 0.3.64-150500.3.7.2
pipewire-spa-tools-debuginfo - addressed in versions 0.3.24-150300.4.8.1, 0.3.49-150400.3.7.1, 0.3.64-150500.3.7.2
pipewire-modules-debuginfo - update to 0.3.24-150300.4.8.1
pipewire-doc - addressed in versions 0.3.24-150300.4.8.1, 0.3.49-150400.3.7.1, 0.3.64-150500.3.7.2
pipewire-tools - addressed in versions 0.3.24-150300.4.8.1, 0.3.49-150400.3.7.1, 0.3.64-150500.3.7.2
pipewire-libjack-0_3-64bit - addressed in versions 0.3.24-150300.4.8.1, 0.3.49-150400.3.7.1, 0.3.64-150500.3.7.2
gstreamer-plugin-pipewire - addressed in versions 0.3.24-150300.4.8.1, 0.3.49-150400.3.7.1, 0.3.64-150500.3.7.2
libpipewire-0_3-0-debuginfo - addressed in versions 0.3.24-150300.4.8.1, 0.3.49-150400.3.7.1, 0.3.64-150500.3.7.2
libpipewire-0_3-0-64bit - addressed in versions 0.3.24-150300.4.8.1, 0.3.49-150400.3.7.1, 0.3.64-150500.3.7.2
pipewire-modules-64bit-debuginfo - update to 0.3.24-150300.4.8.1
pipewire-pulseaudio - addressed in versions 0.3.24-150300.4.8.1, 0.3.49-150400.3.7.1, 0.3.64-150500.3.7.2
libpipewire-0_3-0-64bit-debuginfo - addressed in versions 0.3.24-150300.4.8.1, 0.3.49-150400.3.7.1, 0.3.64-150500.3.7.2
pipewire-libjack-0_3 - addressed in versions 0.3.24-150300.4.8.1, 0.3.49-150400.3.7.1, 0.3.64-150500.3.7.2
pipewire-modules-64bit - update to 0.3.24-150300.4.8.1
pipewire-libjack-0_3-64bit-debuginfo - addressed in versions 0.3.24-150300.4.8.1, 0.3.49-150400.3.7.1, 0.3.64-150500.3.7.2
pipewire-spa-plugins-0_2 - addressed in versions 0.3.24-150300.4.8.1, 0.3.49-150400.3.7.1, 0.3.64-150500.3.7.2
pipewire-lang - addressed in versions 0.3.24-150300.4.8.1, 0.3.49-150400.3.7.1, 0.3.64-150500.3.7.2
pipewire-spa-plugins-0_2-64bit-debuginfo - addressed in versions 0.3.24-150300.4.8.1, 0.3.49-150400.3.7.1, 0.3.64-150500.3.7.2
pipewire-spa-plugins-0_2-64bit - addressed in versions 0.3.24-150300.4.8.1, 0.3.49-150400.3.7.1, 0.3.64-150500.3.7.2
pipewire-modules - update to 0.3.24-150300.4.8.1
gstreamer-plugin-pipewire-debuginfo - addressed in versions 0.3.24-150300.4.8.1, 0.3.49-150400.3.7.1, 0.3.64-150500.3.7.2
pipewire-modules-0_3 - addressed in versions 0.3.49-150400.3.7.1, 0.3.64-150500.3.7.2
pipewire-libjack-0_3-devel - addressed in versions 0.3.49-150400.3.7.1, 0.3.64-150500.3.7.2
pipewire-modules-0_3-debuginfo - addressed in versions 0.3.49-150400.3.7.1, 0.3.64-150500.3.7.2
pipewire-alsa-32bit-debuginfo - addressed in versions 0.3.49-150400.3.7.1, 0.3.64-150500.3.7.2
pipewire-modules-0_3-64bit - addressed in versions 0.3.49-150400.3.7.1, 0.3.64-150500.3.7.2
pipewire-alsa-64bit - addressed in versions 0.3.49-150400.3.7.1, 0.3.64-150500.3.7.2
pipewire-alsa-64bit-debuginfo - addressed in versions 0.3.49-150400.3.7.1, 0.3.64-150500.3.7.2
pipewire-modules-0_3-64bit-debuginfo - addressed in versions 0.3.49-150400.3.7.1, 0.3.64-150500.3.7.2
pipewire-alsa-32bit - addressed in versions 0.3.49-150400.3.7.1, 0.3.64-150500.3.7.2
pipewire-modules-0_3-32bit - addressed in versions 0.3.49-150400.3.7.1, 0.3.64-150500.3.7.2
pipewire-modules-0_3-32bit-debuginfo - addressed in versions 0.3.49-150400.3.7.1, 0.3.64-150500.3.7.2
pipewire-module-x11-0_3-debuginfo - update to 0.3.64-150500.3.7.2
pipewire-module-x11-0_3 - update to 0.3.64-150500.3.7.2
xdg-desktop-portal - addressed in versions 1.8.0-150200.5.8.1, 1.10.1-150400.3.8.1, 1.16.0-150400.3.8.1, 1.16.0-150500.3.8.1
xdg-desktop-portal-devel - addressed in versions 1.8.0-150200.5.8.1, 1.10.1-150400.3.8.1, 1.16.0-150400.3.8.1, 1.16.0-150500.3.8.1
xdg-desktop-portal-debugsource - addressed in versions 1.8.0-150200.5.8.1, 1.10.1-150400.3.8.1, 1.16.0-150400.3.8.1, 1.16.0-150500.3.8.1
xdg-desktop-portal-lang - addressed in versions 1.8.0-150200.5.8.1, 1.10.1-150400.3.8.1, 1.16.0-150400.3.8.1, 1.16.0-150500.3.8.1
xdg-desktop-portal-debuginfo - addressed in versions 1.8.0-150200.5.8.1, 1.10.1-150400.3.8.1, 1.16.0-150400.3.8.1, 1.16.0-150500.3.8.1
firefox - addressed in versions 140.0-1.fc41, 140.0-1.fc42
MozillaThunderbird - update to 140.1.0-150200.8.230.1
MozillaThunderbird-translations-common - update to 140.1.0-150200.8.230.1
MozillaThunderbird-translations-other - update to 140.1.0-150200.8.230.1
MozillaThunderbird-debugsource - update to 140.1.0-150200.8.230.1
MozillaThunderbird-debuginfo - update to 140.1.0-150200.8.230.1
MozillaFirefox-debuginfo - update to 140.1.0-150200.152.193.1
MozillaFirefox-branding-upstream - update to 140.1.0-150200.152.193.1
MozillaFirefox-translations-other - update to 140.1.0-150200.152.193.1
MozillaFirefox - update to 140.1.0-150200.152.193.1
MozillaFirefox-devel - update to 140.1.0-150200.152.193.1
MozillaFirefox-debugsource - update to 140.1.0-150200.152.193.1
MozillaFirefox-translations-common - update to 140.1.0-150200.152.193.1
thunderbird (Ubuntu package) - update to 1:140.7.1+build1-0ubuntu0.22.04.1
MozillaFirefox-branding-SLE - update to 140-150200.9.21.1

• https://www.mozilla.org/en-US/security/advisories/mfsa2025-51/
• https://bugzilla.mozilla.org/show_bug.cgi?id=1955182

• Multiple vulnerabilities in Mozilla Firefox
• Fedora 41 update for firefox
• Fedora 42 update for firefox
• Multiple vulnerabilities in Thunderbird
• SUSE update for MozillaFirefox, MozillaFirefox-branding-SLE
• SUSE update for MozillaThunderbird
• Ubuntu update for thunderbird