CVE-2025-10859
📋 TL;DR
This vulnerability in Firefox for iOS incorrectly shared cookie storage between private (Incognito) and normal browsing sessions, allowing data from private tabs to leak into regular browsing even after closing all private tabs. It affects Firefox for iOS users with versions below 143.1.
💻 Affected Systems
- Firefox for iOS
📦 What is this software?
Firefox by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
Sensitive browsing data (cookies, session tokens, authentication data) from private browsing sessions could be accessed by websites in normal browsing mode, potentially exposing private accounts or activities.
Likely Case
Websites visited in normal browsing mode could access cookies or session data from previously visited private browsing sessions, compromising privacy expectations.
If Mitigated
With proper patching, no data leakage occurs between private and normal browsing modes as intended.
🎯 Exploit Status
Exploitation requires the user to visit malicious websites in normal browsing mode after using private browsing. No authentication bypass or remote code execution involved.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 143.1
Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2025-79/
Restart Required: No
Instructions:
1. Open the App Store on your iOS device. 2. Search for Firefox. 3. Tap 'Update' next to Firefox. 4. Wait for the update to complete. 5. Launch Firefox to verify the update.
🔧 Temporary Workarounds
Disable Private Browsing
iOSAvoid using private browsing mode in Firefox for iOS until patched.
Clear All Cookies After Private Browsing
iOSManually clear all cookies and site data after using private browsing sessions.
🧯 If You Can't Patch
- Use an alternative browser for private browsing sessions.
- Avoid logging into sensitive accounts while using Firefox for iOS private browsing.
🔍 How to Verify
Check if Vulnerable:
Check Firefox version in Settings > About Firefox. If version is below 143.1, the device is vulnerable.Check Version:
Open Firefox > Settings > About FirefoxVerify Fix Applied:
After updating, verify version is 143.1 or higher in Settings > About Firefox.📡 Detection & Monitoring
Log Indicators:
- No specific log indicators for this privacy leakage vulnerability.
Network Indicators:
- No specific network indicators; this is a client-side privacy issue.
SIEM Query:
Not applicable for client-side privacy vulnerabilities.