r3m0t3nu11/cve-2025-1015an attacker to create and export an address book containing a malicious payload in a field. For example, in the “Other” field of the Instant Messaging section. If another user imported the address book, clicking on the link could result in opening a web page inside Thunderbird, and that page could execute (unprivileged) JavaScript
CVE-2025-1015: The Thunderbird Address Book contains unsanitized URI fields that could be exploited by attackers. By creating an address book with malicious links, an attacker may trick another user into importing the compromised address book. If the user clicks on the unsanitized link within Thunderbird, it could lead to arbitrary execution of unprivileged JavaScript on a webpage opened within the Thunderbird client. This poses significant security risks as it may allow attackers to manipulate user sessions or steal sensitive information.
