CVE-2025-23108

Description

Opening Javascript links in a new tab via long-press in the Firefox iOS client could result in a malicious script spoofing the URL of the new tab. This vulnerability affects Firefox for iOS < 134.

Reserved 2025-01-10 | Published 2025-01-11 | Updated 2025-01-13 | Assigner mozilla

Problem types

Firefox Mobile iOS Full Address Bar Spoof Using Open in New Tab and Javascript URI

Product status

Any version before 134
affected

Credits

Renwa

References

bugzilla.mozilla.org/show_bug.cgi?id=1933172

www.mozilla.org/security/advisories/mfsa2025-06/

cve.org (CVE-2025-23108)

nvd.nist.gov (CVE-2025-23108)

Download JSON