CVE-2025-3029: Mozilla Firefox

High severity, CVSS 7.3. EPSS: 0.3% chance of exploitation in the next 30 days.

A crafted URL containing specific Unicode characters could have hidden the true origin of the page, resulting in a potential spoofing attack. This vulnerability was fixed in Firefox 137, Firefox ESR 128.9, Thunderbird 137, and Thunderbird 128.9.

Affected products

• Mozilla Firefox: before 128.9.0 (fixed in 128.9.0); before 137.0 (fixed in 137.0)
• Mozilla Thunderbird: before 128.9.0 (fixed in 128.9.0); from 129.0, before 137.0 (fixed in 137.0)

Published 2025-04-01. Last modified 2026-10-05.