CVE-2025-54143CWE-693

CVE-2025-54143

Critical · published August 20, 2025

CVSS v3.1
9.8
EPSS
0%
Percentile
40.5
In the wild
Unconfirmed
What it is

🚨 A sneaky bypass in sandboxed iframes could allow unauthorized downloads to your device, leaving the door wide open! 🔥 Think of it as a hotel room that was supposed to be protected by security but has a hidden entrance no one checked — guests could waltz right in anytime! This could lead to absolutely devastating scenarios where malicious files find their way onto users' devices, potentially compromising sensitive data or introducing malware. Users expect their browsers to keep them safe, and bypassing these sandbox restrictions is a huge betrayal of that trust.

Put simply

Think of it as a hotel room that was supposed to be protected by security but has a hidden entrance no one checked — guests could waltz right in anytime! CVE-2025-54143 allows malicious code within sandboxed iframes to circumvent restrictions set by the parent page, enabling unintended file downloads directly to the device.

What to do

This could lead to absolutely devastating scenarios where malicious files find their way onto users' devices, potentially compromising sensitive data or introducing malware. Users expect their browsers to keep them safe, and bypassing these sandbox restrictions is a huge betrayal of that trust. To secure your environment, immediately update Firefox for iOS to version 141 or later. Educate users to avoid interacting with untrusted content until they have updated, as this could expose them to risks. This is fixable! Get that update rolling and feel like a security hero in no time! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00481 · 40.5th percentile
Weakness
CWE-693 · Protection Mechanism Failure
Published
2025-08-20T01:15Z
Affected products (1)
ProductVersionsFixed in
mozilla/firefox< 141.0141.0
References (2)
EPSS history
Timeline
  • 19 AUG 20:52Z
    Sandboxed iframes could allow local downloads despite sandbox restrictions
    cvelistv5