CVE-2025-13013 Mitigation bypass in the DOM: Core & HTML component

Medium 6.1 Published 11 Nov 2025 Updated 13 Apr 2026

An attacker can bypass security mitigations in the DOM component of Firefox and Thunderbird, potentially enabling further exploitation.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2025-13013?

CVE-2025-13013 is a medium-severity vulnerability in Mozilla Firefox, published on 11 Nov 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Mitigation bypass in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Firefox ESR 115.30, Thunderbird 145, and Thunderbird 140.5.

Weakness: CWE-288

Which versions are affected by CVE-2025-13013?

It affects 1 product.

Products include Mozilla Firefox.

How do I fix CVE-2025-13013?

Upgrade to a fixed version.

Is CVE-2025-13013 being exploited?

There is no known exploitation of CVE-2025-13013 in the wild and no public exploit code.

All Mozilla Firefox vulnerabilities

Sources

Also known as DEBIAN-CVE-2025-13013, GHSA-vcwp-4m7w-hxfh, UBUNTU-CVE-2025-13013.