The vulnerability CVE-2025-8029 involves Mozilla Firefox and Thunderbird executing javascript: URLs when embedded in object and embed HTML tags. This could allow execution of JavaScript code in contexts where it was not intended, potentially leading to security risks such as cross-site scripting. Mozilla addressed this issue in Firefox 141 and corresponding ESR and Thunderbird versions. The CVSS 3.1 base score is 8.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and high confidentiality and integrity impact. The vendor advisory explicitly states the fix is included in the mentioned versions.

Successful exploitation could allow an attacker to execute arbitrary JavaScript code via object and embed tags containing javascript: URLs, potentially compromising confidentiality and integrity of user data. The CVSS score of 8.1 reflects a high impact on confidentiality and integrity. However, the vendor advisory classifies the impact of this specific vulnerability as moderate within the broader set of fixes. There are no reports of active exploitation in the wild.

This vulnerability has been fixed in Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1. Users and administrators should update to these versions or later to remediate the issue. No additional mitigation steps are required beyond applying the official updates.