CVE-2023-5725

What it actually does

A malicious installed WebExtension can open arbitrary URLs, enabling collection of sensitive user data under specific conditions in affected browser versions.

Why it matters to the business

Potential exposure of user data could result in privacy violations, regulatory penalties, and loss of trust; the vulnerability has been public for years with stable low exploitation likelihood and no known ransomware use.

How an attack unfolds

An attacker develops a WebExtension that bypasses restrictions to open chosen URLs, allowing data harvesting when the extension is installed by a user; no named threat actors or campaigns are associated with this issue.

How to fix it

Update Firefox to version 119 or later, Firefox ESR to 115.4 or later, and Thunderbird to 115.4.1 or later; on Debian 11 systems apply the package update to the fixed version 5.10.209-1.

How to confirm the fix worked

Verify installed browser and extension versions against the fixed releases; review extension permissions and test URL handling behavior in updated instances.

Typical attack path

1. Craft and distribute malicious WebExtension
2. User installs the extension
3. Extension opens arbitrary URLs in the background
4. Attacker collects sensitive data transmitted or displayed via those URLs

How to detect it

Review browser logs and extension activity for unexpected URL navigation patterns originating from add-ons; examine installed extensions for suspicious behavior or origins.

What your security team should do

• Prioritize updates to fixed browser versions across all endpoints
• Audit installed WebExtensions for unexpected permissions
• Monitor EPSS and KEV status for any future changes in exploit availability