CVE-2025-11717
📋 TL;DR
This vulnerability in Firefox for Android allows attackers to view password-related screens when switching between apps using the card carousel. Previously, Firefox 144 fixed an issue where password edit screens were visible in app switcher previews. This affects Firefox for Android versions before 144.
💻 Affected Systems
- Firefox for Android
📦 What is this software?
Firefox by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
Attackers could capture sensitive password information from app switcher previews when users switch away from Firefox password screens.
Likely Case
Local attackers or malicious apps could view password-related screens in the Android app switcher, potentially exposing credential information.
If Mitigated
With Firefox 144+, password screens are properly obscured in app switcher previews, preventing information disclosure.
🎯 Exploit Status
Exploitation requires local access to the device or a malicious app that can trigger app switching while password screens are active.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firefox 144
Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2025-81/
Restart Required: Yes
Instructions:
1. Open Google Play Store 2. Search for Firefox 3. Update to version 144 or later 4. Restart Firefox after update
🔧 Temporary Workarounds
Avoid password screens in app switcher
androidManually close Firefox or switch to home screen before leaving device unattended when using password features
🧯 If You Can't Patch
- Disable Firefox password manager and use third-party password managers
- Enable device screen lock and never leave device unattended when using Firefox password features
🔍 How to Verify
Check if Vulnerable:
Check Firefox version in Settings > About Firefox. If version is less than 144, you are vulnerable.Check Version:
In Firefox: Settings > About FirefoxVerify Fix Applied:
Update to Firefox 144+, then test by opening password screen and switching apps - password screen should show black preview.📡 Detection & Monitoring
Log Indicators:
- No specific log indicators for this vulnerability
Network Indicators:
- No network indicators - local vulnerability only
SIEM Query:
Not applicable - local information disclosure vulnerability