When a URL was provided in a link querystring parameter, Firefox for Android would follow that URL instead of the correct URL, potentially leading to phishing attacks. *This bug only affects Firefox for Android. Other versions of Firefox are unaffected.*. This vulnerability was fixed in Firefox 140.
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Suse | — | Upgrade pipewire-toolsUpgrade gstreamer-plugin-pipewireUpgrade mozillafirefox-branding-sleUpgrade pipewireUpgrade xdg-desktop-portal-develUpgrade pipewire-langUpgrade pipewire-spa-plugins-0_2Upgrade pipewire-spa-toolsUpgrade MozillaFirefoxUpgrade pipewire-modules-0_3Upgrade libpipewire-0_3-0Upgrade MozillaFirefox-develUpgrade xdg-desktop-portalUpgrade pipewire-modulesUpgrade xdg-desktop-portal-langUpgrade mozillafirefox-branding-upstreamUpgrade MozillaFirefox-translations-commonUpgrade MozillaFirefox-translations-other | Jul 22, 2025 | Jun 24, 2025 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Jun 24, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub
