CVE-2025-27425CWE-287

CVE-2025-27425

Medium · published March 4, 2025

CVSS v3.1

4.3

EPSS

Percentile

13.2

In the wild

Unconfirmed

What it is

Scanning certain QR codes that included text with a website URL could allow the URL to be opened without presenting the user with a confirmation alert first. This vulnerability was fixed in Firefox for iOS 136.

The record

Technical detail

CVSS v3.1: 4.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00231 · 13.2th percentile
Weakness: CWE-287 · Improper Authentication
Published: 2025-03-04T19:15Z

Affected products (1)

Product	Versions	Fixed in
mozilla/firefox	< 136.0	136.0

References (2)

https://bugzilla.mozilla.org/show_bug.cgi?id=1941525 · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-13/ · [email protected]

EPSS history

Timeline

04 MAR 13:31Z
QR code user confirmation bypass with invalid protocol
cvelistv5