CVE-2025-11720CWE-451

CVE-2025-11720

High · published October 14, 2025

CVSS v3.1
8.1
EPSS
0%
Percentile
17.9
In the wild
Unconfirmed
What it is

The Firefox and Firefox Focus UI for the Android custom tab feature only showed the "site" that was loaded, not the full hostname. User supplied content hosted on a subdomain of a site could have been used to fool a user into thinking it was content from a different subdomain of that site. This vulnerability was fixed in Firefox 144.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00268 · 17.9th percentile
Weakness
CWE-451 · User Interface (UI) Misrepresentation of Critical Information
Published
2025-10-14T17:15Z
Affected products (1)
ProductVersionsFixed in
mozilla/firefox< 144.0144.0
References (3)
https://bugzilla.mozilla.org/show_bug.cgi?id=1979534 · [email protected]https://bugzilla.mozilla.org/show_bug.cgi?id=1984370 · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-81/ · [email protected]
EPSS history
Timeline
  • 14 OCT 12:27Z
    Spoofing risk in Android custom tabs
    cvelistv5