CVE-2025-14744
📋 TL;DR
This vulnerability allows malicious websites to use Unicode Right-to-Left Override (RTLO) characters to spoof filenames in Firefox for iOS downloads UI. Attackers could trick users into saving files with unexpected file extensions, potentially leading to malware execution. Only Firefox for iOS versions before 144.0 are affected.
💻 Affected Systems
- Firefox for iOS
📦 What is this software?
Firefox by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
Users download what appears to be a safe file (like .pdf) but actually receives executable malware (.exe disguised as .pdf), leading to device compromise.
Likely Case
Users download files with incorrect extensions, potentially opening malicious content in inappropriate applications or being tricked into running scripts.
If Mitigated
Users notice the unusual filename or browser warnings, preventing file execution.
🎯 Exploit Status
Exploitation requires user to visit malicious website and initiate download, but no authentication or special privileges needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 144.0
Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2025-97/
Restart Required: No
Instructions:
1. Open App Store on iOS device. 2. Search for Firefox. 3. Tap Update to version 144.0 or later. 4. Launch Firefox to apply update.
🔧 Temporary Workarounds
Use alternative browser
iosTemporarily use Safari or other browsers until Firefox is updated.
Disable automatic downloads
iosConfigure Firefox to ask before downloading files.
🧯 If You Can't Patch
- Educate users to verify file extensions before opening downloaded files
- Implement web filtering to block known malicious sites
🔍 How to Verify
Check if Vulnerable:
Check Firefox version in Settings > About Firefox. If version is less than 144.0, device is vulnerable.Check Version:
Not applicable for iOS - check via app interfaceVerify Fix Applied:
Confirm Firefox version is 144.0 or higher in Settings > About Firefox.📡 Detection & Monitoring
Log Indicators:
- Unusual download filenames containing RTLO characters
- Multiple failed file type validations
Network Indicators:
- Connections to suspicious domains followed by downloads
- HTTP requests with unusual filename parameters
SIEM Query:
source="firefox_ios" AND (event="download" AND filename MATCHES "\\u202E")