CVE-2025-4085 describes a vulnerability in Mozilla Firefox and Thunderbird's UITour actor component. An attacker with control over a content process could potentially abuse the privileged UITour actor to either leak sensitive information or escalate privileges. This vulnerability is classified under CWE-269 (Improper Privilege Management). It was addressed and fixed in Firefox 138 and Thunderbird 138. The CVSS 3.1 base score is 7.1, with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, indicating network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact.

Successful exploitation could allow an attacker who already has control over a content process to leak sensitive information or escalate privileges within the browser environment. This could compromise user data confidentiality and potentially allow further unauthorized actions within the affected applications. There are no reports of active exploitation in the wild.

This vulnerability has been fixed in Mozilla Firefox 138 and Thunderbird 138. Users and administrators should update to these versions or later to remediate the issue. Since this is a client-side application vulnerability, applying the official updates is the recommended and effective mitigation. Patch status is confirmed by the vendor advisory.