Mozilla Firefox versions prior to 141 cached Cross-Origin Resource Sharing (CORS) preflight responses across changes in IP addresses. This caching behavior allowed attackers to bypass CORS restrictions via DNS rebinding techniques. The vulnerability is tracked as CVE-2025-8036 and was addressed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1. The CVSS 3.1 base score is 8.1, indicating high impact with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality and integrity impacts. The vendor advisory explicitly states the fix and references the bug report 1960834.

Successful exploitation of this vulnerability could allow an attacker to circumvent CORS security policies by leveraging DNS rebinding, potentially enabling unauthorized cross-origin requests that violate the same-origin policy. This could lead to disclosure or manipulation of sensitive data accessible via the browser. The CVSS score of 8.1 reflects high confidentiality and integrity impact but no availability impact. There are no known exploits in the wild at this time.

Mozilla has released official fixes for this vulnerability in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1. Users and administrators should upgrade to these versions or later to remediate the issue. No additional mitigation steps are required beyond applying the official updates.