The vulnerability CVE-2025-8037 involves the handling of cookies in Mozilla Firefox. Specifically, when a nameless cookie is set with an equals sign in its value, it can shadow other cookies, including those that have the Secure attribute and were set over HTTPS. This behavior can undermine cookie security by allowing an insecure cookie to override a secure one. The issue affects Firefox and Thunderbird prior to versions Firefox 141 and ESR 140.1. Mozilla has released official fixes for this vulnerability in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1. The CVSS v3.1 base score is 9.1 (critical), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality and integrity.

The vulnerability allows an attacker to shadow secure cookies with nameless cookies set over HTTP, potentially leading to unauthorized access or manipulation of cookie-based authentication or session management mechanisms. This undermines the security guarantees provided by the Secure attribute on cookies, potentially exposing sensitive user data or enabling session hijacking. The CVSS score of 9.1 indicates a critical impact on confidentiality and integrity. However, no known exploits in the wild have been reported as of the advisory date.

Mozilla has released official fixes for this vulnerability in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1. Users and administrators should update to these versions or later to remediate the issue. Since this is a client-side vulnerability in Firefox and Thunderbird, patching the affected software is the primary and recommended mitigation. No additional vendor-recommended mitigations or workarounds are indicated in the advisory.