CVE-2025-8031 involves improper handling of URLs in Content Security Policy reports by Mozilla Firefox and Thunderbird. Specifically, the username:password segment of URLs was not correctly removed, potentially exposing HTTP Basic Authentication credentials in CSP reports. This vulnerability was fixed in Firefox 141 and corresponding ESR and Thunderbird versions. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. The vendor advisory confirms the fix and includes this vulnerability among several others addressed in the July 2025 security updates.

If exploited, this vulnerability could lead to the disclosure of HTTP Basic Authentication credentials through CSP reports, potentially allowing attackers to gain unauthorized access to protected resources. The CVSS score of 9.8 indicates critical severity with high impact on confidentiality, integrity, and availability. However, no known exploits in the wild have been reported to date.

Mozilla has released official fixes for this vulnerability in Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1. Users and administrators should update to these versions or later to remediate the issue. Since the vulnerability is fixed in these releases, no additional mitigation steps are required beyond applying the official updates.