CVE-2025-23108
📋 TL;DR
This vulnerability in Firefox for iOS allows malicious JavaScript links opened via long-press to spoof the URL displayed in the new tab, potentially tricking users into believing they're on a legitimate site. It affects Firefox for iOS users running versions below 134. The issue is a cross-site scripting (XSS) vulnerability that exploits the browser's tab handling behavior.
💻 Affected Systems
- Firefox for iOS
📦 What is this software?
Firefox by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
Attackers could create convincing phishing pages that appear to be legitimate websites, potentially leading to credential theft, financial fraud, or malware installation.
Likely Case
Users could be tricked into entering sensitive information on spoofed websites, leading to credential harvesting or financial loss.
If Mitigated
With proper user awareness and updated browsers, the impact is limited to visual deception without direct code execution on the device.
🎯 Exploit Status
Exploitation requires user interaction (long-press) and social engineering to trick users into clicking malicious JavaScript links.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firefox for iOS 134
Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2025-06/
Restart Required: Yes
Instructions:
1. Open the App Store on your iOS device. 2. Search for Firefox. 3. Tap Update to install Firefox for iOS 134 or later. 4. Restart Firefox after update completes.
🔧 Temporary Workarounds
Disable JavaScript
iosDisable JavaScript execution in Firefox settings to prevent the vulnerability from being triggered
Avoid Long-Press on Links
allTrain users to avoid long-pressing on links, especially from untrusted sources
🧯 If You Can't Patch
- Use alternative browsers until Firefox can be updated
- Implement web filtering to block known malicious domains and JavaScript-based attacks
🔍 How to Verify
Check if Vulnerable:
Check Firefox version in iOS Settings > Firefox > AboutCheck Version:
Not applicable for iOS apps; check via iOS Settings appVerify Fix Applied:
Verify Firefox version is 134 or higher in iOS Settings > Firefox > About📡 Detection & Monitoring
Log Indicators:
- Unusual JavaScript link interactions in browser logs
- Multiple tab creations from single user sessions
Network Indicators:
- Traffic to domains with spoofed URLs in referrer headers
- JavaScript files with URL manipulation code
SIEM Query:
Not typically applicable for client-side browser vulnerabilities