The vulnerability CVE-2025-5263 in Mozilla Firefox involves improper isolation of error handling for script execution from web content, which could allow cross-origin leak attacks. This means that error information from scripts could be accessed across origins, potentially exposing sensitive data. Mozilla fixed this vulnerability in Firefox 139 and corresponding ESR and Thunderbird versions. The CVSS 3.1 base score is 4.3 (medium), with attack vector network, low attack complexity, no privileges required, user interaction required, unchanged scope, and low confidentiality impact. The vendor advisory explicitly states the fix is included in Firefox 139 and ESR 115.24 and 128.11 releases.

The vulnerability could allow an attacker to perform cross-origin leak attacks by exploiting improper isolation of error handling in script execution. This may lead to limited confidentiality loss of information accessible via error messages. There is no indication of impact on integrity or availability. No known exploits in the wild have been reported, reducing immediate risk. The medium CVSS score reflects the moderate confidentiality impact and the requirement for user interaction.

Official fixes for this vulnerability are available and have been released in Firefox 139, Firefox ESR 115.24, Firefox ESR 128.11, Thunderbird 139, and Thunderbird 128.11. Users and administrators should update to these versions or later to remediate the issue. No additional mitigation steps are required beyond applying these updates as per the Mozilla security advisories.