The vulnerability CVE-2025-6434 affects the HTTPS-Only exception page in Mozilla Firefox and Thunderbird. The page lacked an anti-clickjacking delay, which could enable an attacker to use clickjacking techniques to trick users into allowing an exception to the HTTPS-Only mode, causing the browser to load a webpage over HTTP. This issue was addressed and fixed in Firefox 140 and Thunderbird 140 releases. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, and low integrity impact.

The impact is limited to the potential for an attacker to trick a user into bypassing HTTPS-Only mode and loading a webpage over an unencrypted HTTP connection. This could reduce the security guarantees of HTTPS, potentially exposing the user to risks inherent in unencrypted HTTP traffic. However, the vulnerability does not directly compromise confidentiality or availability and requires user interaction to exploit. There are no known exploits in the wild.

This vulnerability has been fixed in Mozilla Firefox 140 and Thunderbird 140. Users and administrators should update to these versions or later to ensure the vulnerability is remediated. No additional mitigation steps are required as the fix is official and available.