The vulnerability identified as CVE-2025-8038 involves Firefox incorrectly enforcing the CSP frame-src directive by ignoring path components when validating navigations inside frames. This could allow navigations that should have been blocked by CSP policies. The issue was fixed in Firefox 141 and Firefox ESR 140.1. It is one of multiple vulnerabilities addressed in these releases, with Mozilla providing official security advisories detailing the fixes. The CVSS score for this vulnerability is low, reflecting its limited impact compared to other critical issues fixed simultaneously.

The impact of CVE-2025-8038 is considered low. The vulnerability could allow bypassing CSP frame-src path restrictions, potentially enabling unauthorized frame navigations. However, this issue is less severe than other high-impact memory safety and code execution vulnerabilities fixed in the same Firefox releases. There are no known exploits in the wild for this specific vulnerability.

Mozilla has released official fixes for this vulnerability in Firefox 141 and Firefox ESR 140.1. Users and administrators should update affected Firefox and Thunderbird versions to these or later releases to remediate the issue. Since the vulnerability is patched, no additional mitigation steps are required beyond applying the official updates.