Setting a nameless cookie with an equals sign in the value shadowed other cookies. Even if the nameless cookie was set over HTTP and the shadowed cookie included the `Secure` attribute. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade firefoxUpgrade firefox-esrUpgrade thunderbirdUpgrade thunderbird-esr | Jul 25, 2025 | Jul 24, 2025 |
| Mfsa2025 56 | — | Upgrade to Mozilla Firefox version 141.0Upgrade to the latest version of Mozilla Firefox | Jul 23, 2025 | Jul 22, 2025 |
| Mfsa2025 59 | — | Upgrade to the latest version of Mozilla FirefoxUpgrade to Mozilla Firefox ESR version 140.1 | Jul 23, 2025 | Jul 22, 2025 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 140.1Upgrade to the latest version of Mozilla Thunderbird | Jul 23, 2025 | Jul 22, 2025 |
| Suse | — | Upgrade pipewire-modulesUpgrade MozillaFirefoxUpgrade mozillafirefox-branding-upstreamUpgrade MozillaThunderbird-translations-commonUpgrade libpipewire-0_3-0Upgrade mozillafirefox-branding-sleUpgrade MozillaFirefox-translations-otherUpgrade pipewire-toolsUpgrade xdg-desktop-portalUpgrade MozillaFirefox-develUpgrade pipewire-spa-toolsUpgrade pipewireUpgrade xdg-desktop-portal-langUpgrade xdg-desktop-portal-develUpgrade gstreamer-plugin-pipewireUpgrade pipewire-modules-0_3Upgrade MozillaThunderbirdUpgrade pipewire-spa-plugins-0_2Upgrade MozillaFirefox-translations-commonUpgrade pipewire-langUpgrade MozillaThunderbird-translations-other | Dec 5, 2025 | Jul 25, 2025 |
| Ubuntu | — | Upgrade thunderbird | Jul 24, 2025 | Jul 22, 2025 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub