CVE-2025-5267 is a clickjacking vulnerability affecting Mozilla Firefox and Thunderbird that could allow an attacker to deceive a user into unintentionally exposing saved payment card information to a malicious webpage. This issue was resolved in Firefox 139, Firefox ESR 128.11, Thunderbird 139, and Thunderbird 128.11. The vulnerability is classified under CWE-1021 and has a CVSS v3.1 base score of 5.4 (medium severity), with an attack vector of network, low attack complexity, no privileges required, user interaction required, and impacts confidentiality and integrity but not availability. The vendor advisory explicitly states the fix is included in the mentioned versions.

Successful exploitation of this vulnerability could lead to the unauthorized disclosure of saved payment card details from affected users, potentially resulting in financial information leakage. The impact is limited to confidentiality and integrity with no direct impact on system availability. There are no reports of active exploitation in the wild.

This vulnerability has been fixed in Mozilla Firefox 139, Firefox ESR 128.11, Thunderbird 139, and Thunderbird 128.11. Users and administrators should update to these versions or later to remediate the issue. Since the vendor advisory confirms an official fix is available, applying these updates is the recommended and sufficient mitigation.