CVE-2025-1015 PoC — Mozilla Thunderbird 安全漏洞

Description

an attacker to create and export an address book containing a malicious payload in a field. For example, in the “Other” field of the Instant Messaging section. If another user imported the address book, clicking on the link could result in opening a web page inside Thunderbird, and that page could execute (unprivileged) JavaScript

介绍

CVE-2025-1015: Unsanitized address book fields on  thunderbird thunderbird_esr128 and below 
an attacker to create and export an address book containing a malicious payload in a field. For example, in the “Other” field of the Instant Messaging section. If another user imported the address book, clicking on the link could result in opening a web page inside Thunderbird, and that page could execute (unprivileged) JavaScript



<img width="412" alt="cve-new" src="https://github.com/user-attachments/assets/ca138a57-b042-4e26-8c38-9ed03bca50bf" />

文件快照

备注