When a URL was provided in a link querystring parameter, Firefox for Android would follow that URL instead of the correct URL, potentially leading to phishing attacks. *This bug only affects Firefox for Android. Other versions of Firefox are unaffected.*. This vulnerability was fixed in Firefox 140.
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Suse | — | Upgrade mozillafirefox-branding-sleUpgrade xdg-desktop-portal-develUpgrade mozillafirefox-translations-otherUpgrade pipewireUpgrade mozillafirefox-translations-commonUpgrade pipewire-langUpgrade gstreamer-plugin-pipewireUpgrade pipewire-spa-plugins-0_2Upgrade pipewire-toolsUpgrade mozillafirefox-develUpgrade pipewire-modulesUpgrade mozillafirefoxUpgrade xdg-desktop-portalUpgrade libpipewire-0_3-0Upgrade pipewire-spa-toolsUpgrade pipewire-modules-0_3Upgrade mozillafirefox-branding-upstreamUpgrade xdg-desktop-portal-lang | Jul 22, 2025 | Jun 24, 2025 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Jun 24, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub
