CVE-2025-3523: When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header, only the last link is shown when...
Description
When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header, only the last link is shown when hovering over any attachment. Although the correct link is used on click, the misleading hover text could trick users into downloading content from untrusted sources. This vulnerability affects Thunderbird < 137.0.2 and Thunderbird < 128.9.2.
Classification
CVE ID: CVE-2025-3523
Problem Types
User Interface (UI) Misrepresentation of attachment URLAffected Products
Vendor: Mozilla
Product: Thunderbird, Thunderbird
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.03% (probability of being exploited)
EPSS Percentile: 9.03% (scored less or equal to compared to others)
EPSS Date: 2025-04-21 (when was this score calculated)
References
https://nvd.nist.gov/vuln/detail/CVE-2025-3523https://bugzilla.mozilla.org/show_bug.cgi?id=1958385
https://www.mozilla.org/security/advisories/mfsa2025-26/
https://www.mozilla.org/security/advisories/mfsa2025-27/