The vulnerability CVE-2025-8036 involves Firefox and Thunderbird caching CORS preflight responses across changes in IP addresses. This caching flaw allowed attackers to bypass CORS restrictions by leveraging DNS rebinding techniques. The issue was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1. The CVSS 3.1 base score is 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N), reflecting a network attack vector with low complexity, no privileges required, user interaction needed, unchanged scope, and high confidentiality and integrity impacts. The vendor advisory explicitly states the fix availability and does not indicate any ongoing mitigation requirements beyond updating.

Successful exploitation of this vulnerability could allow an attacker to circumvent CORS protections, potentially leading to unauthorized access to sensitive cross-origin resources, impacting confidentiality and integrity of user data. There is no indication of availability impact. No known exploits have been reported in the wild at this time.

An official fix is available and has been released in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1. Users and administrators should update to these versions or later to remediate this vulnerability. No additional mitigation steps are required as per the vendor advisory.