CVE-2025-5020 Details
Description
Opening maliciously-crafted URLs in Firefox from other apps such as Safari could have allowed attackers to spoof website addresses if the URLs utilized non-HTTP schemes used internally by the Firefox iOS client. This vulnerability was fixed in Firefox for iOS 139.
A vulnerability in Firefox for iOS versions prior to 139 allows for URL spoofing. This issue arises when maliciously crafted URLs are opened in Firefox from other apps, such as Safari, and the URLs use non-HTTP schemes that are internally managed by the Firefox iOS client.
Users can upgrade to Firefox for iOS version 139 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 21, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://bugzilla.mozilla.org/show_bug.cgi?id=1951558 | [email protected] | Permissions Required |
| https://www.mozilla.org/security/advisories/mfsa2025-39/ | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-939 | Improper Authorization in Handler for Custom URL Scheme | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| mozilla firefox | < 139.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 13, 2026 | CVE Modified | [email protected] |
| Jun 13, 2025 | Initial Analysis | [email protected] |
| May 21, 2025 | CVE Modified | CISA-ADP |
| May 21, 2025 | New CVE Received | [email protected] |