CVE-2025-4088

CVE.org · Published

Record status: Published
Identifier year (not publication year): 2025
Source publication: Apr 29, 2025
Source updated: Apr 13, 2026
Imported by cveboard: Oct 24, 2026
Source snapshot: cve_2026-10-24_midnight_baseline · Oct 24, 2026

CNA source text (English)

Cross-site request forgery via storage access API redirects

A security vulnerability in Thunderbird allowed malicious sites to use redirects to send credentialed requests to arbitrary endpoints on any site that had invoked the Storage Access API. This enabled potential Cross-Site Request Forgery attacks across origins. This vulnerability was fixed in Firefox 138 and Thunderbird 138.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

Firefox

Vendor: Mozilla
Product: Firefox
Platforms: Unknown
Default status: Unknown

Firefox · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
138	`unaffected`	rpm	Unavailable	*	None listed

Thunderbird

Vendor: Mozilla
Product: Thunderbird
Platforms: Unknown
Default status: Unknown

Thunderbird · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
138	`unaffected`	rpm	Unavailable	*	None listed