CVE-2023-25729

What it actually does

Extensions bypass permission prompts for external protocol schemes by invoking them via ExpandedPrincipals rather than ContentPrincipals, allowing silent launch of registered handlers.

Why it matters to the business

Attackers can trigger file downloads or launch installed applications without user consent, increasing risk of malware delivery or unauthorized system interaction across browser fleets.

How an attack unfolds

An attacker supplies a malicious extension that registers interest in external schemes and uses ExpandedPrincipals to open them directly, bypassing the missing prompt and leading to downloads or interaction with local software.

How to fix it

Upgrade Firefox to 110 or later, Thunderbird to 102.8 or later, and Firefox ESR to 102.8 or later; remove or disable untrusted extensions until updates are applied.

How to confirm the fix worked

Verify installed versions meet or exceed the fixed releases; test that external-scheme permission prompts now appear for ExpandedPrincipals in a controlled extension.

Typical attack path

1. User installs a malicious or compromised extension
2. Extension code constructs an ExpandedPrincipal to reference an external scheme
3. Scheme handler is invoked without triggering the permission prompt
4. Attacker downloads files or launches installed applications to achieve further actions

How to detect it

Review extension activity logs and browser console output for external scheme invocations that lack corresponding user-prompt audit events; search for extensions referencing ExpandedPrincipals in their code.

What your security team should do

• Apply the listed updates immediately across all endpoints
• Audit installed extensions and revoke those with broad protocol or download capabilities
• Enable enterprise update policies to enforce automatic browser updates going forward