CVE-2025-55031
📋 TL;DR
This vulnerability in Firefox and Focus for iOS allows malicious web pages to trigger hybrid passkey transport via FIDO links. An attacker within Bluetooth range could trick users into using their passkeys to log the attacker's computer into the target account. This affects Firefox for iOS and Focus for iOS users on versions below 142.
💻 Affected Systems
- Firefox for iOS
- Focus for iOS
📦 What is this software?
Firefox by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
An attacker within Bluetooth range could gain unauthorized access to user accounts by tricking victims into authenticating the attacker's device with their passkeys, potentially compromising sensitive accounts.
Likely Case
Targeted attacks in public spaces where attackers could exploit Bluetooth proximity to trick users into authenticating malicious devices, leading to account compromise.
If Mitigated
With updated browsers and user awareness, the risk is significantly reduced as the attack requires specific conditions and user interaction.
🎯 Exploit Status
Exploitation requires attacker to be within Bluetooth range and user to interact with malicious web content.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 142
Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2025-68/
Restart Required: Yes
Instructions:
1. Open the App Store on iOS. 2. Tap your profile icon. 3. Scroll to find Firefox or Focus. 4. Tap 'Update' next to the app. 5. Restart the browser after update completes.
🔧 Temporary Workarounds
Disable Bluetooth when not in use
iosTurn off Bluetooth to prevent attackers from being within range for exploitation.
Open Control Center > Tap Bluetooth icon to disable
Avoid untrusted websites
allDo not visit or interact with suspicious or untrusted websites while using Firefox/Focus on iOS.
🧯 If You Can't Patch
- Disable Bluetooth when browsing on Firefox/Focus for iOS
- Use alternative browsers until patched
🔍 How to Verify
Check if Vulnerable:
Open Firefox/Focus for iOS > Settings > Scroll to bottom to check version number.Check Version:
Not applicable for iOS apps; check in app settings.Verify Fix Applied:
Confirm version is 142 or higher in app settings after update.📡 Detection & Monitoring
Log Indicators:
- Unusual FIDO authentication attempts via Bluetooth
- Multiple failed passkey authentications from unknown devices
Network Indicators:
- Bluetooth pairing requests from unknown devices during web browsing
SIEM Query:
Not typically applicable for mobile browser vulnerabilities on personal devices.