CVE-2025-10859CWE-359

CVE-2025-10859

Medium · published September 30, 2025

CVSS v3.1

4.0

EPSS

Percentile

1.7

In the wild

Unconfirmed

What it is

Cookie storage for non-HTML temporary documents was being shared incorrectly with normal browsing content, allowing information from private tabs to escape Incognito mode even after the user closed all tabs. This vulnerability was fixed in Firefox for iOS 143.1.

The record

Technical detail

CVSS v3.1: 4.0 · MEDIUM
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00120 · 1.7th percentile
Weakness: CWE-359 · Exposure of Private Personal Information to an Unauthorized Actor
Published: 2025-09-30T17:15Z

Affected products (1)

Product	Versions	Fixed in
mozilla/firefox	< 143.1.0	143.1.0

References (2)

https://bugzilla.mozilla.org/show_bug.cgi?id=1684624 · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-79/ · [email protected]

EPSS history

Timeline

30 SEP 12:49Z
Data stored in cookies for non-HTML content while browsing Incognito could be viewed after closing private tabs
cvelistv5