CVE-2025-4090 describes an information disclosure vulnerability in Firefox for Android and Thunderbird for Android where sensitive library paths were logged to Logcat, potentially exposing internal file locations. This vulnerability was fixed in Firefox 138 and Thunderbird 138. The CVSS v3.1 base score is 5.3 (medium severity) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, and limited confidentiality impact. The vulnerability is categorized under CWE-532. No known exploits have been reported.

The vulnerability could lead to limited information disclosure by exposing sensitive library paths through Logcat logs on Android devices running Firefox or Thunderbird. This may aid an attacker in reconnaissance but does not directly allow code execution, privilege escalation, or denial of service. The impact is considered low to medium due to the nature of the information leaked and the absence of known exploitation.

This vulnerability has been fixed in Firefox 138 and Thunderbird 138. Users and administrators should update affected applications to these versions or later to remediate the issue. No additional mitigation steps are required as the vendor has provided an official fix.