CVE-2025-0237

What it actually does

The WebChannel API accepted an unverified sending principal instead of validating it, allowing cross-process messages to bypass authorization checks and escalate privileges.

Why it matters to the business

Attackers could gain elevated access inside the browser or email client, increasing risk of data exposure or unauthorized actions on user systems; the issue affects widely deployed open-source clients with large user bases.

How an attack unfolds

An attacker sends a crafted principal through the WebChannel API; because no sending-principal check occurs, the message is accepted and processed with higher privileges than intended, enabling further attacks within the same process or across processes.

How to fix it

Upgrade Firefox to 134 or later, Firefox ESR to 128.6 or later, Thunderbird to 134 or later, and Thunderbird ESR to 128.6 or later. For the listed Ubuntu packages, apply the provided cvs updates (2:1.12.13+real-12ubuntu0.1 or 2:1.12.13+real-15ubuntu0.1) where applicable.

How to confirm the fix worked

Confirm the installed browser or client reports the fixed version string; re-test WebChannel message flows to ensure principals are validated before acceptance.

Typical attack path

1. Identify a target running an affected Firefox or Thunderbird build
2. Deliver content or a script that can reach the WebChannel API
3. Send a forged principal via the API
4. Abuse the resulting elevated context to read or modify data across processes

How to detect it

Review browser process logs and telemetry for unexpected cross-process messages carrying unverified principals; look for post-exploitation artifacts such as unauthorized access to privileged browser components.

What your security team should do

• Prioritize patching all Firefox and Thunderbird instances to the versions listed above within the next patch cycle
• Monitor vendor advisories for any follow-on updates
• Review internal application code that interacts with WebChannel or similar cross-process APIs for similar missing principal checks