Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-gc2w-91t5-2qbr
Vulnerability ID VCID-gc2w-91t5-2qbr
Aliases CVE-2025-3859
Summary Websites directing users to long URLs that caused eliding to occur in the location view could leverage the truncating behavior to potentially trick users into thinking they were on a different webpage. This vulnerability was fixed in Focus 138.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (0)
There are no known CWE.
System Score Found at
epss 0.00277 https://api.first.org/data/v1/epss?cve=CVE-2025-3859
epss 0.00277 https://api.first.org/data/v1/epss?cve=CVE-2025-3859
cvssv3.1 4.3 https://bugzilla.mozilla.org/show_bug.cgi?id=1951533
ssvc Track https://bugzilla.mozilla.org/show_bug.cgi?id=1951533
generic_textual none https://www.mozilla.org/en-US/security/advisories/mfsa2025-33
cvssv3.1 4.3 https://www.mozilla.org/security/advisories/mfsa2025-33/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2025-33/
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2025-3859
mfsa2025-33 https://www.mozilla.org/en-US/security/advisories/mfsa2025-33
mfsa2025-33 https://www.mozilla.org/security/advisories/mfsa2025-33/
show_bug.cgi?id=1951533 https://bugzilla.mozilla.org/show_bug.cgi?id=1951533
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N Found at https://bugzilla.mozilla.org/show_bug.cgi?id=1951533
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-30T17:13:54Z/ Found at https://bugzilla.mozilla.org/show_bug.cgi?id=1951533
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N Found at https://www.mozilla.org/security/advisories/mfsa2025-33/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-30T17:13:54Z/ Found at https://www.mozilla.org/security/advisories/mfsa2025-33/
Exploit Prediction Scoring System (EPSS)
Percentile 0.51451
EPSS Score 0.00277
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T17:18:32.155059+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2025/3xxx/CVE-2025-3859.json 38.6.0