CVE-2025-5266 involves a cross-origin information leak vulnerability in Mozilla Firefox and Thunderbird products. Specifically, script elements that load cross-origin resources would generate load and error events that could be observed, leaking information that enables XS-Leaks attacks. This vulnerability was fixed in Firefox 139, Firefox ESR 128.11, Thunderbird 139, and Thunderbird 128.11. The CVSS 3.1 base score is 4.3 (medium), with attack vector network, low attack complexity, no privileges required, user interaction required, unchanged scope, and low confidentiality impact. The vendor advisory explicitly lists this vulnerability among several fixed in the stated versions and confirms the fix is available.

The vulnerability allows an attacker to infer information about cross-origin resource loading by observing load and error events on script elements, which can be used to conduct XS-Leaks attacks. This can lead to partial leakage of cross-origin resource status information but does not directly enable code execution or denial of service. The impact is limited to confidentiality with low severity as per the CVSS score. No known active exploitation has been reported.

An official fix is available and has been released in Firefox 139, Firefox ESR 128.11, Thunderbird 139, and Thunderbird 128.11. Users and administrators should update to these versions or later to remediate this vulnerability. Since the vendor has provided an official fix, applying the update is the recommended mitigation. No additional action is required beyond patching.