A vulnerability in Thunderbird and Firefox allowed caching of CORS preflight responses across IP address changes, enabling circumvention of CORS protections via DNS rebinding attacks. This issue affects versions of Firefox prior to 141 and Firefox ESR prior to 140.1, as well as Thunderbird versions prior to 141 and 140.1. The vulnerability has been assigned CVE-2025-8036 and is rated with high severity. Mozilla has fixed this issue in Firefox 141 and Thunderbird 141.