CVE-2025-10529 is a vulnerability in Mozilla Firefox's Layout component that allows bypassing the same-origin policy, a critical security mechanism that restricts how documents or scripts loaded from one origin can interact with resources from another origin. This vulnerability was reported by Daniel Holbert and is tracked under Bug 1970490. It was addressed and fixed in Firefox 143 and Firefox ESR 140.3. The CVSS v3.1 base score is 6.5, reflecting a network attack vector with low complexity, no privileges required, and no user interaction needed, impacting confidentiality and integrity but not availability.

The vulnerability enables an attacker to bypass the same-origin policy, potentially allowing unauthorized access to sensitive information across different web origins. This could lead to information disclosure or manipulation of web content that should otherwise be isolated. However, the impact is rated moderate by Mozilla, and no active exploitation has been reported. The fix eliminates the risk by correcting the underlying issue in the Layout component.

Mozilla has released official patches fixing this vulnerability in Firefox 143 and Firefox ESR 140.3. Users and administrators should update their Firefox installations to these versions or later to remediate the vulnerability. Since this is a client-side browser vulnerability, applying the official update is the primary and recommended mitigation. No additional vendor-recommended mitigations or workarounds are indicated.