Skip to content
CVE PROGRAM SOURCE RECORD7.3 High

CVE-2025-1936

Adding %00 and a fake extension to a jar: URL changed the interpretation of the contents

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
mozilla

Description

jar: URLs retrieve local file content packaged in a ZIP archive. The null and everything after it was ignored when retrieving the content from the archive, but the fake extension after the null was used to determine the type of content. This could have been used to hide code in a web extension disguised as something else like an image. This vulnerability was fixed in Firefox 136, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Mozilla Firefox

  • 128.8 to ≤ 128.*unaffected
  • 136 to ≤ *unaffected

Mozilla Thunderbird

  • 128.8 to ≤ 128.*unaffected
  • 136 to ≤ *unaffected

References