Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.1
CVE-2025-8039: Firefox and Thunderbird may retain search terms in address bar
CVE-2025-8039 · published 1 year ago
Summary
In certain situations, words you typed into the search box can stay visible in the browser's address bar even after you leave the search page. This could let others who look at your screen see what you searched for. Update Firefox to version 141 or newer, Firefox ESR to 140.1 or newer, and Thunderbird to 141 or newer to remove the issue.
What to do
- Update canonical thunderbird to version 1:140.7.1+build1-0ubuntu0.22.04.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | mozilla | firefox |
< 140.1 < 141.0 cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:* |
| – | mozilla | thunderbird |
< 140.1 < 141.0 cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:* |
| Ubuntu:18.04:LTS | canonical | mozjs52 | All versions |
| Ubuntu:18.04:LTS | canonical | mozjs38 | All versions |
| Ubuntu:20.04:LTS | canonical | mozjs68 | All versions |
| Ubuntu:22.04:LTS | canonical | mozjs102 | All versions |
| Ubuntu:22.04:LTS | canonical | mozjs78 | All versions |
| Ubuntu:22.04:LTS | canonical | mozjs91 | All versions |
| Ubuntu:22.04:LTS | canonical | thunderbird |
< 1:140.7.1+build1-0ubuntu0.22.04.1 Fix: upgrade to 1:140.7.1+build1-0ubuntu0.22.04.1
|
| Ubuntu:24.04:LTS | canonical | mozjs115 | All versions |
Original advisory text
In some cases search terms persisted in the URL bar even after navigating away from the search page. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird...
In some cases search terms persisted in the URL bar even after navigating away from the search page. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1.
References
- https://ubuntu.com/security/CVE-2025-8039 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2025-8039 Third Party Advisory
- https://www.mozilla.org/en-US/security/advisories/mfsa2025-56/#CVE-2025-8039 Third Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1970997 Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2025-56/ Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2025-59/ Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2025-61/ Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2025-63/ Third Party Advisory
- https://ubuntu.com/security/notices/USN-7991-1 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-200Information Exposure
Timeline
Published22 Jul 2025
Updated4 Nov 2026
First seen7 Mar 2026
Track software like this
Free during beta