CVE-2025-3029

A crafted URL containing specific Unicode characters could have hidden the true origin of the page, resulting in a potential spoofing attack. This vulnerability affects Firefox < 137, Firefox ESR < 128.9, Thunderbird < 137, and Thunderbird < 128.9.

Published: Apr 1, 2025
Updated: May 4, 2025
CVE: CVE-2025-3029
Exploit:

No technical information available.

No CWE or OWASP classifications available.

Affected Software
References

Software	From	Fixed in
mozilla / firefox	-	137.0
mozilla / firefox	-	128.9.0
mozilla / thunderbird	-	128.9.0
mozilla / thunderbird	129.0	137.0

https://bugzilla.mozilla.org/show_bug.cgi?id=1952213
https://www.mozilla.org/security/advisories/mfsa2025-20/
https://www.mozilla.org/security/advisories/mfsa2025-22/
https://www.mozilla.org/security/advisories/mfsa2025-23/
https://www.mozilla.org/security/advisories/mfsa2025-24/

Vulnerability Database

CVE-2025-3029

Deep Security Visibility Without the Complexity