CVE-2025-5266 is a vulnerability in Firefox versions prior to 139 and Firefox ESR prior to 128.11 where script elements loading cross-origin resources generated load and error events that leaked information. This leakage enables cross-site leaks (XS-Leaks) attacks. The issue has been addressed in Firefox 139 and Firefox ESR 128.11.