When a URL was provided in a link querystring parameter, Firefox for Android would follow that URL instead of the correct URL, potentially leading to phishing attacks. *This bug only affects Firefox for Android. Other versions of Firefox are unaffected.*. This vulnerability was fixed in Firefox 140.
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Suse | — | Upgrade xdg-desktop-portal-langUpgrade MozillaFirefoxUpgrade pipewire-modulesUpgrade libpipewire-0_3-0Upgrade pipewire-modules-0_3Upgrade pipewire-spa-toolsUpgrade xdg-desktop-portalUpgrade MozillaFirefox-develUpgrade MozillaFirefox-translations-otherUpgrade mozillafirefox-branding-upstreamUpgrade MozillaFirefox-translations-commonUpgrade pipewireUpgrade pipewire-toolsUpgrade gstreamer-plugin-pipewireUpgrade mozillafirefox-branding-sleUpgrade xdg-desktop-portal-develUpgrade pipewire-spa-plugins-0_2Upgrade pipewire-lang | Jul 22, 2025 | Jun 24, 2025 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Jun 24, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub