CVE-2025-8037

The cookie handling mechanism in Firefox and Thunderbird improperly processes unnamed cookies whose value contains an equals sign. Such a cookie causes shadowing of other cookies with the same key name in the value. Critically, a malicious cookie set over HTTP can shadow a cookie protected by the `Secure` attribute, which should ensure that the cookie is available only over encrypted HTTPS connections. As a result, the `Secure` protection mechanism is ineffectively enforced (CWE-614).

An attacker can shadow sensitive session or authentication cookies protected by the `Secure` attribute, potentially taking control of the user's session or gaining unauthorized access to resources protected by these cookies. Both the confidentiality and integrity of session data may be compromised.

Software should be updated to the following versions: Firefox 141 or Firefox ESR 140.1, Thunderbird 141 or Thunderbird 140.1. Updates are available from the manufacturer according to the references (mfsa2025-56, mfsa2025-59, mfsa2025-61, mfsa2025-63).

Mozilla Firefox prior to version 141 and Firefox ESR prior to version 140.1, as well as Mozilla Thunderbird prior to version 141 and Thunderbird ESR prior to version 140.1.