CVE-2025-11720 — User Interface (UI) Misrepresentation of Critical Information in Mozilla Firefox

CWE-451 — User Interface (UI) Misrepresentation of Critical Information6 documents6 sources

Severity

8.1HIGHNVD

EPSS

0.0%

top 86.83%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Mozilla Firefox

Timeline

PublishedOct 14

Description

The Firefox and Firefox Focus UI for the Android custom tab feature only showed the "site" that was loaded, not the full hostname. User supplied content hosted on a subdomain of a site could have been used to fool a user into thinking it was content from a different subdomain of that site. This vulnerability was fixed in Firefox 144.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:NExploitability: 2.8 | Impact: 5.2

Affected Packages1 packages

▶NVDmozilla/firefox< 144.0

🔴Vulnerability Details

OSV

CVE-2025-11720: The Firefox and Firefox Focus UI for the Android custom tab feature only showed the "site" that was loaded, not the full hostname↗2025-10-14

▶

GHSA

GHSA-wjv8-8vf9-mrv8: The Firefox and Firefox Focus UI for the Android custom tab feature only showed the "site" that was loaded, not the full hostname↗2025-10-14

▶

CVEList

Spoofing risk in Android custom tabs↗2025-10-14

▶

📋Vendor Advisories

Debian

CVE-2025-11720: firefox - The Firefox and Firefox Focus UI for the Android custom tab feature only showed ...↗2025

▶

Mozilla

Mozilla Foundation Security Advisory 2025-81: CVE-2025-11720↗

▶