CVE-2025-6431
📋 TL;DR
This vulnerability allows attackers to bypass Firefox for Android's external link prompt, potentially exposing users to security vulnerabilities or privacy leaks in external applications. Only Firefox for Android versions below 140 are affected; other Firefox versions remain secure.
💻 Affected Systems
- Firefox for Android
📦 What is this software?
Firefox by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
Attackers could silently launch malicious external applications that steal sensitive data, execute arbitrary code, or compromise device security without user consent.
Likely Case
Attackers trick users into clicking malicious links that bypass the prompt, potentially exposing data to vulnerable external apps or tracking user activity.
If Mitigated
With updated Firefox and cautious browsing, users maintain control over external link handling with proper prompts.
🎯 Exploit Status
Exploitation requires user interaction (clicking a malicious link) but bypasses the security prompt.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 140
Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2025-51/
Restart Required: Yes
Instructions:
1. Open Google Play Store. 2. Search for Firefox. 3. Tap Update to version 140 or higher. 4. Restart Firefox after update.
🔧 Temporary Workarounds
Disable external link handling
androidConfigure Firefox to block all external link openings
about:config → search 'external' → set 'browser.link.open_external' to 2
🧯 If You Can't Patch
- Disable Firefox for Android and use alternative secure browser
- Educate users to avoid clicking unknown links and monitor for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Open Firefox for Android → Menu → Settings → About Firefox → Check version numberCheck Version:
Not applicable for Android; check via app settingsVerify Fix Applied:
Confirm Firefox version is 140 or higher in About Firefox settings📡 Detection & Monitoring
Log Indicators:
- Unexpected external application launches from Firefox without user prompts
- Firefox crash logs related to link handling
Network Indicators:
- Suspicious redirects to external app protocols (e.g., intent://, market://) from web traffic
SIEM Query:
Not typically applicable for mobile app vulnerabilities