CVE-2025-4090

What it actually does

The flaw causes potentially sensitive library file paths to be written to Android Logcat output during normal operation of Thunderbird for Android.

Why it matters to the business

Attackers who can obtain device logs gain visibility into application internals, which may support reconnaissance for additional attacks; the exposure is limited to information disclosure without direct system compromise.

How an attack unfolds

An attacker with access to Logcat output (via ADB, a malicious app with log permissions, or physical device access) reads the logged library locations to map the application's runtime environment and identify potential follow-on attack surfaces.

How to fix it

Upgrade Mozilla Thunderbird for Android and Mozilla Firefox to version 138 or later to eliminate the unnecessary logging of library locations.

How to confirm the fix worked

After upgrading, capture Logcat output while exercising the application and confirm that no sensitive library paths appear in the logs.

Typical attack path

1. Obtain access to Android Logcat output through ADB, privileged app, or device compromise
2. Filter logs for Thunderbird library path entries
3. Analyze disclosed paths to understand application structure and dependencies
4. Leverage gathered information to craft targeted follow-on attacks

How to detect it

Review historical Logcat captures or device logs for entries containing Thunderbird library paths; correlate with known application startup or library load events.

What your security team should do

• Immediately update all instances of Thunderbird for Android and Firefox to version 138 or newer
• Audit Android device logging policies to restrict Logcat access to authorized personnel only
• Include Logcat review in periodic mobile application security assessments