CVE-2025-1941
📋 TL;DR
This vulnerability allows attackers to bypass authentication requirements for Firefox's Focus feature when users have enabled authentication protection. It affects all Firefox users running versions below 136 who have enabled the Focus authentication setting.
💻 Affected Systems
- Mozilla Firefox
📦 What is this software?
Firefox by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
An attacker could gain unauthorized access to sensitive browser sessions, saved credentials, or personal data when the user has stepped away from their computer.
Likely Case
Local attackers or malware could bypass authentication protections to access browser tabs and data that should be protected.
If Mitigated
With proper physical security controls and user awareness, the risk is limited to scenarios where an attacker has physical access to an unlocked device.
🎯 Exploit Status
Exploitation requires local access to the device and knowledge of the bypass method. No public exploit code has been identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firefox 136
Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2025-14/
Restart Required: Yes
Instructions:
1. Open Firefox. 2. Click the menu button (three horizontal lines). 3. Select Help > About Firefox. 4. Firefox will automatically check for updates and prompt to install Firefox 136. 5. Restart Firefox when prompted.
🔧 Temporary Workarounds
Disable Focus Authentication
allTemporarily disable the Focus feature's authentication requirement until patching is complete.
1. Open Firefox Settings
2. Navigate to Privacy & Security
3. Find Focus settings and disable authentication requirement
🧯 If You Can't Patch
- Implement strict physical security controls to prevent unauthorized access to workstations
- Educate users to lock their workstations when stepping away and use full disk encryption
🔍 How to Verify
Check if Vulnerable:
Check Firefox version in Help > About Firefox. If version is below 136 and Focus authentication is enabled, the system is vulnerable.Check Version:
firefox --version (Linux/macOS) or check About Firefox in GUIVerify Fix Applied:
Verify Firefox version is 136 or higher in Help > About Firefox.📡 Detection & Monitoring
Log Indicators:
- Multiple failed authentication attempts followed by successful Focus access
- Unexpected Focus session activations
Network Indicators:
- None - this is a local authentication bypass
SIEM Query:
Search for Firefox process execution events followed by Focus-related activity without authentication logs