CVE-2025-5020 — Links using non-HTTP schemes opened from other apps such as Safari could have allowed spoofing of website addresses

CVE-2025-5020

Links using non-HTTP schemes opened from other apps such as Safari could have allowed spoofing of website addresses PUBLISHED

Description (CNA)

Opening maliciously-crafted URLs in Firefox from other apps such as Safari could have allowed attackers to spoof website addresses if the URLs utilized non-HTTP schemes used internally by the Firefox iOS client. This vulnerability was fixed in Firefox for iOS 139.

Affected (CNA)

Vendor / product	Versions
Mozilla / Firefox for iOS	unaffected 139 through *

CWE

No CWE identifiers supplied.

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1951558
https://www.mozilla.org/security/advisories/mfsa2025-39/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.