CVE-2025-1941 — Missing Authentication for Critical Function in Mozilla Firefox

CWE-306 — Missing Authentication for Critical Function CWE-284 — Improper Access Control CWE-1286 — Improper Validation of Syntactic Correctness of Input8 documents8 sources

Severity

9.1CRITICALNVD

CNA3.3OSV3.3

EPSS

0.1%

top 79.52%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Mozilla Firefox

Timeline

PublishedMar 4

Description

Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been be bypassed (distinct from CVE-2025-0245). This vulnerability was fixed in Firefox 136.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NExploitability: 3.9 | Impact: 5.2

Affected Packages1 packages

▶NVDmozilla/firefox< 136.0

🔴Vulnerability Details

OSV

CVE-2025-1941: Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been be bypassed (distinct from CVE-↗2025-03-04

▶

GHSA

GHSA-m793-xp46-r76w: Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been be bypassed (distinct from CVE-↗2025-03-04

▶

CVEList

Lock screen setting bypass in Firefox Focus for Android↗2025-03-04

▶

📋Vendor Advisories

Red Hat

firefox: Lock screen setting bypass in Firefox Focus for Android↗2025-03-04

▶

Debian

CVE-2025-1941: firefox - Under certain circumstances, a user opt-in setting that Focus should require aut...↗2025

▶

Microsoft

Out of Memory issue in ProtocolBuffers for cpp and python↗2022-09-13

▶

Mozilla

Mozilla Foundation Security Advisory 2025-14: CVE-2025-1941↗

▶