CVE-2025-10530
📋 TL;DR
A spoofing vulnerability in Firefox for Android's WebAuthn component allows attackers to bypass authentication by presenting fake credentials. This affects Firefox for Android versions below 143 and Thunderbird versions below 143.
💻 Affected Systems
- Firefox for Android
- Thunderbird
📦 What is this software?
Firefox by Mozilla
Thunderbird by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
Attackers could impersonate legitimate users to access sensitive accounts protected by WebAuthn authentication, potentially leading to data theft or unauthorized actions.
Likely Case
Targeted attacks against specific users to bypass multi-factor authentication on websites using WebAuthn, particularly on Android devices.
If Mitigated
Limited impact if organizations use additional authentication factors beyond WebAuthn or restrict vulnerable browser versions.
🎯 Exploit Status
Exploitation requires user interaction and targeting of specific authentication flows. No public exploits available as of advisory publication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firefox for Android 143, Thunderbird 143
Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2025-73/
Restart Required: No
Instructions:
1. Open Firefox for Android app store. 2. Check for updates. 3. Install Firefox 143 or later. For Thunderbird: 1. Open Thunderbird. 2. Go to Help > About Thunderbird. 3. Install available updates to version 143 or later.
🔧 Temporary Workarounds
Disable WebAuthn
androidTemporarily disable WebAuthn authentication in browser settings
about:config > security.webauth.webauthn = false
🧯 If You Can't Patch
- Use alternative browsers without WebAuthn vulnerabilities for authentication
- Implement additional authentication factors beyond WebAuthn
🔍 How to Verify
Check if Vulnerable:
Check Firefox for Android version in app settings > About Firefox. If version is below 143, system is vulnerable.Check Version:
about:version in Firefox address barVerify Fix Applied:
Confirm Firefox for Android version is 143 or higher in app settings > About Firefox.📡 Detection & Monitoring
Log Indicators:
- Multiple failed WebAuthn authentication attempts followed by successful authentication from same source
- Unusual WebAuthn credential registrations
Network Indicators:
- Suspicious WebAuthn authentication requests to protected resources
SIEM Query:
source="firefox_android" AND event_type="webauthn_auth" AND result="success" AND user_agent contains "Firefox/14[0-2]"