CVE-2025-6427 — connect-src Content Security Policy restriction could be bypassed
An attacker was able to bypass the `connect-src` directive of a Content Security Policy by manipulating subdocuments. This would have also hidden the connections from the Networ…
Published: 2025-06-24 · CVSS: 9.1 · CVSS 3.1
An attacker was able to bypass the `connect-src` directive of a Content Security Policy by manipulating subdocuments. This would have also hidden the connections from the Network tab in Devtools. This vulnerability was fixed in Firefox 140 and Thunderbird 140.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7