CVE-2025-10534 is a spoofing vulnerability affecting the Site Permissions component in Mozilla Firefox. The vulnerability could allow an attacker to misrepresent site permissions to the user, potentially leading to user deception. Mozilla fixed this issue in Firefox 143 and Thunderbird 143 as part of a security update addressing multiple vulnerabilities. The CVSS v3.1 base score is 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N), indicating network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality and integrity impact. Mozilla rates the impact of this specific vulnerability as low. No exploits in the wild have been reported. The fix is included in Firefox 143 and Thunderbird 143.

The vulnerability could allow an attacker to spoof site permissions in Firefox, potentially misleading users about what permissions a website has. This could lead to users granting permissions under false pretenses, impacting confidentiality and integrity. However, Mozilla rates the impact of this specific vulnerability as low. The overall CVSS score is high due to combined factors, but the vendor advisory clarifies the specific impact is low. There are no known exploits in the wild.

Mozilla has released an official fix for this vulnerability in Firefox 143 and Thunderbird 143. Users and administrators should update to these versions or later to remediate the issue. Since the vulnerability is fixed in these releases, no additional mitigation steps are required.