The vulnerability CVE-2025-8037 in Mozilla Firefox involves the handling of cookies where a nameless cookie containing an equals sign in its value shadows other cookies, even if those cookies are set with the Secure attribute over HTTPS. This could lead to security issues related to cookie integrity and confidentiality. The flaw was addressed and fixed in Firefox 141 and Firefox ESR 140.1. The CVSS 3.1 base score is 9.1, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity. The vendor advisories from Mozilla confirm the fix and provide detailed information on this and other vulnerabilities resolved in the same release.

This vulnerability allows a nameless cookie with a specific value to shadow other cookies, including those marked Secure and set over HTTPS, potentially undermining cookie security guarantees. This could lead to unauthorized access or manipulation of cookie data, impacting confidentiality and integrity of user sessions or data protected by cookies. The CVSS score of 9.1 indicates a critical severity level with high impact on confidentiality and integrity. No exploits in the wild are currently known.

Mozilla has released official fixes for this vulnerability in Firefox 141 and Firefox ESR 140.1. Users and administrators should update affected Firefox installations to version 141 or later, or Firefox ESR 140.1 or later, to remediate this issue. Patch status is confirmed by multiple Mozilla security advisories. No additional mitigation steps are required beyond applying the official updates.