The vulnerability identified as CVE-2025-8032 affects Mozilla Firefox and related products by allowing XSLT documents to bypass the Content Security Policy due to improper propagation of the source document during XSLT loading. This bypass could enable attackers to circumvent CSP restrictions designed to prevent unauthorized resource loading or script execution. The issue was resolved in Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird ESR 128.13, and Thunderbird ESR 140.1. The CVSS 3.1 vector indicates the vulnerability is remotely exploitable over the network without privileges, requires user interaction, and impacts confidentiality and integrity with high severity but does not affect availability.

Successful exploitation of this vulnerability could allow an attacker to bypass the Content Security Policy in affected Firefox versions, potentially enabling unauthorized content or script execution that CSP is intended to block. This could lead to confidentiality and integrity compromises in the browser context. However, there are no known exploits in the wild at this time.

Mozilla has released official fixes for this vulnerability in Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird ESR 128.13, and Thunderbird ESR 140.1. Users and administrators should update to these versions or later to remediate the issue. Patch status is confirmed by multiple Mozilla security advisories. No additional mitigation is required beyond applying these updates.