CVE-2025-5020
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Opening specially crafted URLs in Firefox for iOS from other apps such as Safari could have allowed attackers to spoof website addresses if the URLs utilized non-HTTP schemes used internally by the Firefox iOS client. This vulnerability was fixed in Firefox for iOS 139.
Risk Assessment
Risk of phishing and online fraud, as users may be redirected to a fake site without noticing the difference in the address.
Recommendation
Update Firefox for iOS to version 139 or later to mitigate the vulnerability.
Other vulnerabilities in Firefox for iOS
See all- CVE-2023-49060Critical
In Firefox for iOS, an attacker could access internal pages or data by exfiltrating a security key from ReaderMode via the referrerpolicy attribute. This affects Firefox for iOS versions prior to 120.
- CVE-2026-116632Medium
A malicious web page could insert arbitrary text into the FaceTime call prompt shown by iOS, potentially allowing it to display a phishing message inside system UI. This vulnerability was fixed in Firefox for iOS 156.1.
- CVE-2026-116631Medium
A malicious web page could open a tel link in a window that was showing a different website, causing the phone-call prompt to appear as if that site had requested the call. This vulnerability was fixed in Firefox for iOS 156.1.
- CVE-2026-103418High
Firefox for iOS directly interpolated the page's HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in Firefox's privileged content world and bypass the page's Content Security Policy. This vulnerability was fixed in Firefox for iOS 157.1.
- CVE-2026-103417Medium
Firefox for iOS could autofill saved credentials into a new page if cross-origin navigation occurred while the saved-login UI was open. Autofill was not bound to the originating page or rejected when its origin changed. This vulnerability was fixed in Firefox for iOS 157.1.
- CVE-2026-86853Medium
A malicious webpage could repeatedly trigger external URL schemes, causing system prompts or external application launches. This could make Firefox for iOS temporarily unusable until the page is closed. This vulnerability was fixed in Firefox for iOS 155.1.
- CVE-2026-81267Medium
A malicious webpage could stall a popup's cross-origin navigation after commit, causing the address bar to display the destination origin while continuing to render attacker-controlled content. This vulnerability was fixed in Firefox for iOS 155.0.
- CVE-2026-14906Medium
A vulnerability in Firefox for iOS allowed malicious page titles to overwrite saved PDF files or bundled content within the application sandbox. This issue was fixed in version 152.4.
- CVE-2026-13356Medium
A malicious webpage could interrupt a pending navigation by enqueuing a synchronous JavaScript dialog, causing the browser UI to display the destination origin in the address bar while continuing to render attacker-controlled content. This vulnerability was fixed in Firefox for iOS 152.3.
- CVE-2026-53900Medium
Firefox for iOS preserved cookies set on the initial PDF request across cross-origin HTTP redirects, allowing a malicious site to inject arbitrary cookies into requests to an unrelated target domain.
Original NVD description (English source)
Opening maliciously-crafted URLs in Firefox from other apps such as Safari could have allowed attackers to spoof website addresses if the URLs utilized non-HTTP schemes used internally by the Firefox iOS client. This vulnerability was fixed in Firefox for iOS 139.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS