CVE-2025-6434

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 140

Description: The exception page for the HTTPS-Only feature, displayed when a website is opened via HTTP, lacked an anti-clickjacking delay, potentially allowing an attacker to trick a user into granting an exception and loading a webpage over HTTP.

Recommendations: For versions prior to 140, update to version 140 or later to resolve the issue. As a temporary workaround, consider being cautious when granting exceptions for websites, especially when accessing them via HTTP, to minimize the risk of exploitation.