CVE-2025-6427: 
NixOS vulnerability analysis and mitigation

CVE-2025-6427 is a Content Security Policy (CSP) bypass vulnerability in Mozilla Firefox and Thunderbird that allows an attacker to circumvent the connect-src directive by manipulating subdocuments (removed iframes or closed windows). Discovered and reported by Alan Li (lebr0nli), it was publicly disclosed on June 24, 2025, as part of Mozilla Foundation Security Advisory 2025-51. All Firefox versions prior to 140.0 are affected; Thunderbird versions prior to 140.0 are also affected. The vulnerability carries a CVSS v3.1 base score of 9.1 (Critical) per Feedly threat intelligence data, though Mozilla rated its impact as "Moderate" (Mozilla Advisory MFSA2025-51, Mozilla Advisory MFSA2025-54, Red Hat Bugzilla).

The root cause is classified as CWE-693 (Protection Mechanism Failure). When an iframe is removed from the DOM or a popup window is closed, Firefox loses track of the inherited CSP for that document context — specifically, LoadInfo::GetCSP returns nullptr because mClientInfo.isNothing() is true, as both GetOriginalDocument() and GetInnerWindow() return nullptr for the detached document. An attacker can exploit this by creating an about:blank iframe (which inherits the parent's CSP), then detaching it from the DOM while retaining a JavaScript reference, and subsequently using that reference to make network requests (via fetch, navigator.sendBeacon, EventSource, or WebSocket) that bypass the connect-src restriction. Critically, these requests are also hidden from the browser's Network tab in DevTools, making the activity difficult to detect during debugging. The fix, implemented by checking ClientInfo when creating a LoadInfo, was uplifted to Firefox 140 beta (Mozilla Bugzilla).

Successful exploitation allows an attacker to make unauthorized network connections from a victim's browser to arbitrary endpoints, bypassing CSP connect-src restrictions that website operators rely on to prevent data exfiltration and unauthorized resource loading. The high confidentiality and integrity impact scores reflect the potential for sensitive data to be exfiltrated to attacker-controlled servers without the victim's knowledge. Because the network activity is hidden from DevTools, defenders and developers monitoring browser traffic may not detect the malicious connections. The vulnerability also potentially affects other inherited security properties such as iframe sandbox attributes and referrer-policy, broadening the potential impact (Mozilla Bugzilla, Mozilla Advisory MFSA2025-51).

1. Set up a malicious web page: Host a page that sets a strict CSP header including connect-src 'none' to simulate a target environment, or craft a page that will be loaded in a context where the victim site has a restrictive connect-src policy.
2. Create a subdocument: Use JavaScript to create an about:blank iframe or open a popup window (window.open()). The subdocument inherits the parent's CSP, including the connect-src restriction.
3. Retain a reference: Save a JavaScript reference to the iframe's contentWindow or the popup window object before detaching it.
4. Detach the subdocument: Remove the iframe from the DOM (iframe.remove()) or close the popup window (popup.close()). At this point, Firefox loses the CSP context for the detached window.
5. Make restricted network requests: Using the saved window reference, call fetch(), navigator.sendBeacon(), new EventSource(), or new WebSocket() targeting an attacker-controlled server. These requests bypass the connect-src CSP directive and are not shown in the DevTools Network tab.
6. Exfiltrate data: Use the unrestricted network channel to send sensitive data (e.g., cookies, tokens, page content) to the attacker's server, evading both CSP enforcement and developer monitoring (Mozilla Bugzilla).

• Network: Unexpected outbound HTTP/HTTPS POST or GET requests from a browser to unknown or attacker-controlled endpoints that do not correspond to resources permitted by the site's connect-src CSP policy; requests to /fetch, /sendBeacon, or WebSocket/EventSource endpoints on external domains not listed in CSP.
• Logs: Server-side access logs showing POST requests (e.g., /fetch, /sendBeacon) or GET requests (e.g., /EventSource, /WebSocket) originating from browser user agents on pages with restrictive CSP policies; absence of these requests in browser DevTools Network tab despite server-side evidence.
• Browser Behavior: Network activity visible in the browser's multiprocess Browser Console (not the standard Web Console or Network tab) that does not appear in the standard DevTools Network panel, indicating potential CSP bypass exploitation (Mozilla Bugzilla).

Mozilla has released patches in Firefox 140.0 and Thunderbird 140.0, which address this vulnerability by checking ClientInfo when creating a LoadInfo to prevent CSP bypass via detached documents. Users should update Firefox to version 140.0 or later and Thunderbird to version 140.0 or later immediately. ESR branches (115 and 128) will not receive a backport due to the complexity of dependent patches and the moderate severity rating; users on ESR should plan to migrate to Firefox ESR 140 when available. No configuration-based workaround is available for end users, as the flaw is in the browser's CSP enforcement engine (Mozilla Advisory MFSA2025-51, Mozilla Advisory MFSA2025-54, Mozilla Bugzilla).

Mozilla awarded a security bug bounty to the reporter, Alan Li (lebr0nli), recognizing the responsible disclosure. Security news outlets including GBHackers, CyberSecurityNews, and Cybernoz covered the Firefox 140 release in the context of its security fixes, though coverage focused primarily on higher-severity bugs in the same release. The CIS (Center for Internet Security) issued an advisory noting multiple vulnerabilities in Mozilla Thunderbird that could allow arbitrary code execution, referencing this CVE among others. The SUSE and openSUSE Linux distributions issued package update advisories incorporating the fix (Mozilla Bugzilla, CIS Advisory).