CVE-2025-13015

low-risk

Published 2025-11-11

Spoofing issue in Firefox. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, and Firefox ESR 115.30.

Do I need to act?

0.04% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 3.4/10 Low

NETWORK / HIGH complexity

Firefox

Mozilla

Permissions Required https://bugzilla.mozilla.org/show_bug.cgi?id=1994164

Vendor Advisory https://www.mozilla.org/security/advisories/mfsa2025-87/

Vendor Advisory https://www.mozilla.org/security/advisories/mfsa2025-88/

Vendor Advisory https://www.mozilla.org/security/advisories/mfsa2025-89/

/ 100

low-risk

Severity 12/34 · Low

Exploitability 0/34 · Minimal

Exposure 7/34 · Low