CVE-2025-9180: 
NixOS vulnerability analysis and mitigation

CVE-2025-9180 is a same-origin policy bypass vulnerability discovered in the Graphics: Canvas2D component, reported by security researcher Tom Van Goethem. The vulnerability was disclosed on August 19, 2025, affecting multiple versions of Mozilla products including Firefox < 142, Firefox ESR < 115.27, Firefox ESR < 128.14, Firefox ESR < 140.2, Thunderbird < 142, Thunderbird < 128.14, and Thunderbird < 140.2 (Mozilla Advisory).

The vulnerability has been classified with a CVSS v3.1 Base Score of 8.1 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. The vulnerability is categorized under CWE-346 (Origin Validation Error) (NVD).

The vulnerability has been assessed as having a high impact on affected systems. When exploited, it allows attackers to bypass the same-origin policy through the Graphics: Canvas2D component, potentially compromising the confidentiality and integrity of user data (Mozilla Advisory).

Mozilla has released security updates to address this vulnerability across multiple product versions. Users should upgrade to Firefox 142, Firefox ESR 115.27, Firefox ESR 128.14, Firefox ESR 140.2, Thunderbird 142, or their respective latest versions to mitigate this vulnerability (NVD).