The vulnerability identified as CVE-2025-8032 involves improper propagation of the source document during XSLT document loading in Mozilla Firefox, which results in bypassing the Content Security Policy (CSP). CSP is a critical security mechanism designed to prevent cross-site scripting and other code injection attacks by restricting resources the browser is allowed to load. The failure to correctly propagate the source document undermines this protection, potentially allowing malicious content to execute despite CSP restrictions. Mozilla addressed this issue in Firefox 141 and corresponding ESR and Thunderbird versions. The CVSS v3.1 score is 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N), indicating that the vulnerability can be exploited remotely without privileges but requires user interaction, and it impacts confidentiality and integrity with high severity.

Successful exploitation of this vulnerability allows an attacker to bypass the Content Security Policy in affected versions of Firefox and Thunderbird, potentially enabling execution of unauthorized scripts or content that CSP would normally block. This can lead to high confidentiality and integrity impacts, such as data theft or manipulation. There is no indication of availability impact. No known exploits in the wild have been reported at this time.

Mozilla has released official fixes for this vulnerability in Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1. Users and administrators should update to these versions or later to remediate the issue. Since the vulnerability is patched, no additional mitigation steps are required beyond applying the official updates.