CVE-2025-6431CWE-285

CVE-2025-6431

Medium · published June 24, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
15.5
In the wild
Unconfirmed
What it is

When a link can be opened in an external application, Firefox for Android will, by default, prompt the user before doing so. An attacker could have bypassed this prompt, potentially exposing the user to security vulnerabilities or privacy leaks in external applications.

*This bug only affects Firefox for Android. Other versions of Firefox are unaffected.*. This vulnerability was fixed in Firefox 140.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00251 · 15.5th percentile
Weakness
CWE-285 · Improper Authorization
Published
2025-06-24T17:15Z
Affected products (1)
ProductVersionsFixed in
mozilla/firefox< 140.0140.0
References (2)
https://bugzilla.mozilla.org/show_bug.cgi?id=1942716 · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-51/ · [email protected]
EPSS history
Timeline
  • 24 JUN 12:28Z
    The prompt in Firefox for Android that asks before opening a link in an external application could be bypassed
    cvelistv5