CVE-2025-54145
📋 TL;DR
This vulnerability in Firefox for iOS allows malicious websites to be opened automatically when users scan QR codes containing specially crafted URLs. Attackers can trick users into scanning QR codes that exploit Firefox's open-text URL scheme to launch arbitrary websites. Only Firefox for iOS versions below 141 are affected.
💻 Affected Systems
- Firefox for iOS
📦 What is this software?
Firefox by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
Users could be redirected to phishing sites, malware distribution pages, or sites that exploit other browser vulnerabilities, potentially leading to credential theft, malware installation, or further compromise.
Likely Case
Attackers use social engineering to trick users into scanning malicious QR codes, redirecting them to phishing sites or unwanted content.
If Mitigated
With updated Firefox versions and user awareness training, impact is limited to inconvenience from unwanted website openings.
🎯 Exploit Status
Exploitation requires user interaction (scanning QR code) but no authentication. Social engineering makes this practical for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firefox for iOS 141
Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2025-60/
Restart Required: Yes
Instructions:
1. Open the App Store on iOS. 2. Search for Firefox. 3. Tap Update to install version 141 or higher. 4. Restart Firefox after update completes.
🔧 Temporary Workarounds
Disable QR Code Scanning
iosTemporarily disable Firefox's QR code scanning feature until patched.
Not applicable - disable via Firefox settings
Use Alternative QR Scanner
iosUse iOS Camera or dedicated QR scanner apps instead of Firefox's built-in scanner.
🧯 If You Can't Patch
- Educate users to avoid scanning QR codes from untrusted sources
- Implement mobile device management (MDM) policies to restrict Firefox usage
🔍 How to Verify
Check if Vulnerable:
Check Firefox version in iOS Settings > Firefox > Version. If version is below 141, system is vulnerable.Check Version:
Not applicable - check via iOS Settings appVerify Fix Applied:
Confirm Firefox version is 141 or higher in iOS Settings > Firefox > Version.📡 Detection & Monitoring
Log Indicators:
- Unexpected URL openings in Firefox logs
- QR code scan events followed by unusual domain access
Network Indicators:
- Outbound connections to suspicious domains after QR code scans
- Unusual traffic patterns from Firefox mobile clients
SIEM Query:
source="firefox_ios" AND (event="qr_scan" OR url_contains="open-text")