CVE-2025-6435

Public on 2025-06-24
Modified on 2025-06-25
Description
If a user saved a response from the Network tab in Devtools using the Save As context menu option, that file may not have been saved with the `.download` file extension. This could have led to the user inadvertently running a malicious executable. This vulnerability affects Firefox < 140.
Severity
Medium severity
Medium
See what this means
CVSS v3 Base Score
5.0
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
Amazon Linux 2 - Firefox Extra firefox Not Affected
Amazon Linux 2023 firefox Not Affected

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 5.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
NVD CVSSv3 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H