CVE-2025-4090

CVE.org · Published

Record status: Published
Identifier year (not publication year): 2025
Source publication: Apr 29, 2025
Source updated: Apr 13, 2026
Imported by cveboard: Oct 24, 2026
Source snapshot: cve_2026-10-24_midnight_baseline · Oct 24, 2026

CNA source text (English)

Leaked library paths in Thunderbird for Android

A vulnerability existed in Thunderbird for Android where potentially sensitive library locations were logged via Logcat. This vulnerability was fixed in Firefox 138 and Thunderbird 138.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

Firefox

Vendor: Mozilla
Product: Firefox
Platforms: Unknown
Default status: Unknown

Firefox · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
138	`unaffected`	rpm	Unavailable	*	None listed

Thunderbird

Vendor: Mozilla
Product: Thunderbird
Platforms: Unknown
Default status: Unknown

Thunderbird · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
138	`unaffected`	rpm	Unavailable	*	None listed