When a URL was provided in a link querystring parameter, Firefox for Android would follow that URL instead of the correct URL, potentially leading to phishing attacks. *This bug only affects Firefox for Android. Other versions of Firefox are unaffected.*. This vulnerability was fixed in Firefox 140.
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Suse | — | Upgrade pipewire-langUpgrade pipewire-spa-plugins-0_2Upgrade pipewire-toolsUpgrade pipewireUpgrade gstreamer-plugin-pipewireUpgrade mozillafirefox-translations-commonUpgrade mozillafirefox-branding-sleUpgrade xdg-desktop-portal-develUpgrade mozillafirefox-develUpgrade mozillafirefox-translations-otherUpgrade xdg-desktop-portal-langUpgrade xdg-desktop-portalUpgrade pipewire-spa-toolsUpgrade pipewire-modules-0_3Upgrade libpipewire-0_3-0Upgrade mozillafirefoxUpgrade pipewire-modulesUpgrade mozillafirefox-branding-upstream | Jul 22, 2025 | Jun 24, 2025 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Jun 24, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub
