Vulnerability · Published Jun 24, 2025 · Assigned by mozilla
CVE-2025-6431The prompt in Firefox for Android that asks before opening a link in an external application could be bypassed
Medium 6.5
In plain English
A medium-severity security flaw in Firefox from Mozilla. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).
Official description
When a link can be opened in an external application, Firefox for Android will, by default, prompt the user before doing so. An attacker could have bypassed this prompt, potentially exposing the user to security vulnerabilities or privacy leaks in external applications. *This bug only affects Firefox for Android. Other versions of Firefox are unaffected.*. This vulnerability was fixed in Firefox 140.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:22.04:LTS | mozjs102 | no fix listed | UBUNTU-CVE-2025-6431 |
| Ubuntu:24.04:LTS | mozjs102 | no fix listed | UBUNTU-CVE-2025-6431 |
| Ubuntu:24.04:LTS | mozjs115 | no fix listed | UBUNTU-CVE-2025-6431 |
| Ubuntu:22.04:LTS | mozjs78 | no fix listed | UBUNTU-CVE-2025-6431 |
| Ubuntu:22.04:LTS | mozjs91 | no fix listed | UBUNTU-CVE-2025-6431 |
Affected products (as reported)
Weakness: CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N