CVE-2025-4086

What it actually does

A crafted filename with many encoded newline characters can hide the true file extension in the download dialog, causing the displayed name to mislead users about the file type and potentially its purpose.

Why it matters to the business

Users on affected Android clients may be tricked into handling files they believe are safe, increasing the chance of opening malicious content and resulting in data exposure or unauthorized actions.

How an attack unfolds

An attacker crafts a download link or attachment whose filename contains numerous encoded newlines to obscure the extension, then delivers it via email, web page, or messaging; when the user initiates the download on the vulnerable Android client the dialog shows a misleading name that can lead to unintended file execution or handling.

How to fix it

Upgrade affected Mozilla Firefox and Thunderbird clients to version 138 or later; for Thunderbird for Android specifically ensure the update is applied as other Thunderbird versions are not impacted.

How to confirm the fix worked

Confirm the client version is at least 138, test download dialogs with sample filenames containing encoded newlines to verify the extension is no longer obscured, and review update logs for successful application of the fix.

Typical attack path

1. Attacker prepares a file with a specially encoded filename containing many newline characters
2. Attacker hosts or sends the file via a download link, email, or message
3. User on Thunderbird for Android initiates the download
4. Download dialog displays an obscured extension, misleading the user about file type
5. User proceeds with the file, enabling limited confidentiality or integrity impact

How to detect it

Review download logs and file-handling events on Android devices for unexpected file types or user reports of misleading filenames; no widespread exploitation indicators are known given the low EPSS and lack of KEV listing.

What your security team should do

• Prioritize updating Thunderbird for Android clients to version 138 immediately due to the direct user-facing risk
• Apply Firefox 138 updates across the environment to address the related client exposure
• Educate users on verifying file extensions before opening downloads from untrusted sources
• Monitor for any new EPSS increases or exploit reports given the low but present score trend