CVE-2025-10536

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-10536", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "state": "PUBLISHED", "assignerShortName": "mozilla", "dateReserved": "2025-09-16T06:48:50.429Z", "datePublished": "2025-09-16T12:26:36.546Z", "dateUpdated": "2026-04-13T14:28:24.046Z"}, "containers": {"cna": {"affected": [{"product": "Firefox", "vendor": "Mozilla", "versions": [{"status": "unaffected", "version": "140.3", "lessThanOrEqual": "140.*", "versionType": "rpm"}, {"status": "unaffected", "version": "143", "lessThanOrEqual": "*", "versionType": "rpm"}]}, {"product": "Thunderbird", "vendor": "Mozilla", "versions": [{"status": "unaffected", "version": "140.3", "lessThanOrEqual": "140.*", "versionType": "rpm"}, {"status": "unaffected", "version": "143", "lessThanOrEqual": "*", "versionType": "rpm"}]}], "descriptions": [{"lang": "en", "value": "Information disclosure in the Networking: Cache component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Information disclosure in the Networking: Cache component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3."}]}], "title": "Information disclosure in the Networking: Cache component", "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1981502"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-73/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-75/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-77/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-78/"}], "credits": [{"lang": "en", "value": "Ibuki Sato"}], "providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2026-04-13T14:28:24.046Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-200", "lang": "en", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-09-22T17:33:10.783126Z", "id": "CVE-2025-10536", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-22T17:34:03.511Z"}}, {"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/09/msg00026.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/09/msg00020.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T18:08:36.559Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/09/msg00026.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/09/msg00020.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T18:08:36.559Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-10536", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-22T17:33:10.783126Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-16T13:40:31.735Z"}}], "cna": {"title": "Information disclosure in the Networking: Cache component", "credits": [{"lang": "en", "value": "Ibuki Sato"}], "affected": [{"vendor": "Mozilla", "product": "Firefox", "versions": [{"status": "unaffected", "version": "140.3", "versionType": "rpm", "lessThanOrEqual": "140.*"}, {"status": "unaffected", "version": "143", "versionType": "rpm", "lessThanOrEqual": "*"}]}, {"vendor": "Mozilla", "product": "Thunderbird", "versions": [{"status": "unaffected", "version": "140.3", "versionType": "rpm", "lessThanOrEqual": "140.*"}, {"status": "unaffected", "version": "143", "versionType": "rpm", "lessThanOrEqual": "*"}]}], "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1981502"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-73/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-75/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-77/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-78/"}], "descriptions": [{"lang": "en", "value": "Information disclosure in the Networking: Cache component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.", "supportingMedia": [{"type": "text/html", "value": "Information disclosure in the Networking: Cache component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.", "base64": false}]}], "providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2026-04-13T14:28:24.046Z"}}}, "cveMetadata": {"cveId": "CVE-2025-10536", "state": "PUBLISHED", "dateUpdated": "2026-04-13T14:28:24.046Z", "dateReserved": "2025-09-16T06:48:50.429Z", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "datePublished": "2025-09-16T12:26:36.546Z", "assignerShortName": "mozilla"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Firefox", "vendor": "Mozilla", "versions": [{"lessThanOrEqual": "140.*", "status": "unaffected", "version": "140.3", "versionType": "rpm"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "143", "versionType": "rpm"}]}, {"product": "Thunderbird", "vendor": "Mozilla", "versions": [{"lessThanOrEqual": "140.*", "status": "unaffected", "version": "140.3", "versionType": "rpm"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "143", "versionType": "rpm"}]}], "source": "security@mozilla.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*", "matchCriteriaId": "277CA9C0-BD77-46D8-8191-F54598F7F47B", "versionEndExcluding": "140.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*", "matchCriteriaId": "6071B71C-B967-45B9-8CA4-1CB0A9E24D1A", "versionEndExcluding": "143.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*", "matchCriteriaId": "3A5AA31F-5E87-4759-9E8B-D12A91F10CFE", "versionEndExcluding": "140.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*", "matchCriteriaId": "6FA9EF30-CE04-4A16-8083-E3A773AF2AB8", "versionEndExcluding": "143.0", "versionStartIncluding": "141.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Information disclosure in the Networking: Cache component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3."}, {"lang": "es", "value": "Revelaci\u00f3n de informaci\u00f3n en el componente de red: Cach\u00e9. Esta vulnerabilidad afecta a Firefox < 143, Firefox ESR anterior a 140.3, Thunderbird < 143 y Thunderbird anterior a 140.3."}], "id": "CVE-2025-10536", "lastModified": "2026-10-23T22:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10536", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-09-22T17:33:10.783126Z", "version": "2.0.3"}}]}, "published": "2025-09-16T13:15:48.950", "references": [{"source": "security@mozilla.org", "tags": ["Issue Tracking", "Permissions Required"], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1981502"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2025-73/"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2025-75/"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2025-77/"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2025-78/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/09/msg00020.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/09/msg00026.html"}], "sourceIdentifier": "security@mozilla.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2025:16109", "cpe": "cpe:/o:redhat:enterprise_linux:10.0", "package": "firefox-0:140.3.0-1.el10_0", "product_name": "Red Hat Enterprise Linux 10", "release_date": "2025-09-17T00:00:00Z"}, {"advisory": "RHSA-2025:16108", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "firefox-0:140.3.0-1.el9_6", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2025-09-17T00:00:00Z"}], "bugzilla": {"description": "firefox: thunderbird: Information disclosure in the Networking: Cache component", "id": "2395764", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2395764"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N", "status": "verified"}, "details": ["No description is available for this CVE."], "name": "CVE-2025-10536", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "rhel10/firefox-flatpak", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "rhel10/thunderbird-flatpak", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-09-16T12:26:36Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-10536\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-10536\nhttps://www.mozilla.org/security/advisories/mfsa2025-75/#CVE-2025-10536\nhttps://www.mozilla.org/security/advisories/mfsa2025-78/#CVE-2025-10536"], "statement": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", "threat_severity": "Low"}

{"analysis": {"en": {"generated_at": "2026-04-20T19:33:49.843100+00:00", "value": {"mitigation_remediation": ["Upgrade Mozilla Firefox to version 143 or newer, or any ESR build 140.3 or newer.", "Upgrade Mozilla Thunderbird to version 143 or newer, or any ESR build 140.3 or newer.", "If immediate update is not possible, refrain from storing sensitive data in the cache or disable caching features through application preferences where available."], "summary": {"action": "Apply Patch", "impact": "Information Disclosure"}, "threat_synthesis": {"affected_systems": "Mozilla products are affected. Unpatched versions of Firefox and the ESR branch before 143 and 140.3, respectively, as well as Thunderbird before 143 and 140.3, are vulnerable. The vulnerability is present in the baseline builds that include the Networking: Cache component and has been addressed in the listed fixed releases.", "description_and_impact": "A defect in the Networking: Cache component exposes internal cache data, allowing an adversary to read information that should remain confidential. The vulnerability can result in unauthorized disclosure of session data, cached credentials, or other sensitive content stored in the browser or email client. The weakness is a clear case of information exposure (CWE\u2011200) and directly compromises confidentiality, potentially aiding broader attacks if additional data is leaked.", "risk_and_exploitability": "The CVSS base score of 6.2 indicates medium severity, while the EPSS score of less than 1% shows the likelihood of exploitation is very low. The vulnerability is not listed in the CISA KEV catalog, reducing the urgency for zero\u2011day exploitation. Attackers would need to trigger the vulnerable caching path, which may be local or via crafted network traffic; the description does not state an explicit remote exploitation vector, so the attack surface is considered limited. Patching removes the risk, and in the absence of an immediate fix, monitoring for abnormal cache reads is advised."}}}}, "created": "2025-09-17T10:04:54.143595+00:00", "updated": "2026-04-20T19:45:15.503818+00:00", "vendors": ["mozilla", "mozilla$PRODUCT$firefox", "mozilla$PRODUCT$firefox_esr", "mozilla$PRODUCT$thunderbird"]}