CVE-2025-11716 — Improper Access Control in Mozilla Firefox

CWE-284 — Improper Access Control7 documents6 sources
Severity
6.5MEDIUMNVD
EPSS
0.0%
top 92.04%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Mozilla FirefoxMozilla Thunderbird
Timeline
PublishedOct 14

Description

Links in a sandboxed iframe could open an external app on Android without the required "allow-" permission. This vulnerability was fixed in Firefox 144 and Thunderbird 144.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶NVDmozilla/firefox< 144.0
▶NVDmozilla/thunderbird< 144.0

🔴Vulnerability Details

3
OSV
CVE-2025-11716: Links in a sandboxed iframe could open an external app on Android without the required "allow-" permission↗2025-10-14
▶
CVEList
Sandboxed iframes allowed links to open in external apps (Android only)↗2025-10-14
▶
GHSA
GHSA-p8g8-q63w-8jgm: Links in a sandboxed iframe could open an external app on Android without the required "allow-" permission↗2025-10-14
▶

📋Vendor Advisories

3
Debian
CVE-2025-11716: firefox - Links in a sandboxed iframe could open an external app on Android without the re...↗2025
▶
Mozilla
Mozilla Foundation Security Advisory 2025-84: CVE-2025-11716↗
▶
Mozilla
Mozilla Foundation Security Advisory 2025-81: CVE-2025-11716↗
▶
CVE-2025-11716 — Improper Access Control in Mozilla | cvebase