The vulnerability CVE-2025-8029 affects Mozilla Firefox and Thunderbird products prior to version 141 and their ESR counterparts before 128.13 and 140.1. It involves the execution of javascript: URLs when used inside object and embed HTML tags, which should not normally execute such scripts. This behavior could lead to cross-site scripting (CWE-80) issues. Mozilla has addressed this vulnerability by releasing patches in Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1. The CVSS 3.1 vector indicates the vulnerability is remotely exploitable without privileges, requires user interaction, and impacts confidentiality and integrity with high severity.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the affected application, potentially leading to unauthorized access to sensitive information or manipulation of application behavior. The CVSS score of 8.1 reflects a high impact on confidentiality and integrity, though availability is not affected. There are no known exploits in the wild at the time of this advisory.

Mozilla has released official fixes for this vulnerability in Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1. Users and administrators should update to these versions or later to remediate the issue. No additional mitigation steps are required beyond applying these official updates.