CVE-2025-10859

published 2025-09-30

CVE-2025-10859: Cookie storage for non-HTML temporary documents was being shared incorrectly with normal browsing content, allowing information from private tabs to escape…

medium 4 CVSS 3.1

AV L AC L PR N UI N S U C L I N A N

Cookie storage for non-HTML temporary documents was being shared incorrectly with normal browsing content, allowing information from private tabs to escape Incognito mode even after the user closed all tabs. This vulnerability was fixed in Firefox for iOS 143.1.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
debian	firefox	—	—
mozilla	firefox	< 143.1.0	143.1.0
mozilla	firefox	—	—

CWE-359