CVE-2025-5271

CVE.org · Published

Record status: Published
Identifier year (not publication year): 2025
Source publication: May 27, 2025
Source updated: Apr 13, 2026
Imported by cveboard: Oct 24, 2026
Source snapshot: cve_2026-10-24_midnight_baseline · Oct 24, 2026

CNA source text (English)

Devtools' preview ignored CSP headers

Previewing a response in Devtools ignored CSP headers, which could have allowed content injection attacks. This vulnerability was fixed in Firefox 139 and Thunderbird 139.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

Firefox

Vendor: Mozilla
Product: Firefox
Platforms: Unknown
Default status: Unknown

Firefox · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
139	`unaffected`	rpm	Unavailable	*	None listed

Thunderbird

Vendor: Mozilla
Product: Thunderbird
Platforms: Unknown
Default status: Unknown

Thunderbird · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
139	`unaffected`	rpm	Unavailable	*	None listed