CVE-2025-4084: mozilla firefox Improper Encoding or Escaping of Output
Vulnerability summary
CVE-2025-4084 is a medium (CVSS 5.7) Improper Encoding or Escaping of Output vulnerability in mozilla firefox. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 36.7% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 3 · Related 5Timeline
- 29-04-2025PublishedVulnerability first disclosed.
- 13-04-2026Last modifiedVulnerability information updated.
Description
Due to insufficient escaping of the special characters in the "copy as cURL" feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's system. *This bug only affects Firefox for Windows. Other versions of Firefox are unaffected.*. This vulnerability was fixed in Firefox ESR 128.10, Firefox ESR 115.23, and Thunderbird 128.10.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST5.7MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.44%
Chance of exploitation in the next 30 days
Percentile
37%
Versus all other CVEs
30-day change
+0.03 pp
From 0.41% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard2 products
- firefox< 128.10-r0
- firefox-esr< 115.23-r0
Mozilla2 products
- firefox< 115.23 | ≥ 128.0, < 128.10
- thunderbird< 128.10.0
Wolfi1 product
- firefox< 128.10-r0
3 vendors · 5 products
References
5 links- www.mozilla.org/security/advisories/mfsa2025-29/Vendor Advisory
- www.mozilla.org/security/advisories/mfsa2025-30/Vendor Advisory
- www.mozilla.org/security/advisories/mfsa2025-32/Vendor Advisory
