CVE-2025-27424

CWE-601 — Open RedirectCWE-502 — Deserialization of Untrusted Data7 documents7 sources
Severity
4.3MEDIUM
EPSS
0.4%
top 40.57%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Mozilla Firefox FOR IOSMozilla Firefox
Timeline
PublishedMar 4
Latest updateDec 23

Description

Websites redirecting to a non-HTTP scheme URL could allow a website address to be spoofed for a malicious page This vulnerability affects Firefox for iOS < 136.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages2 packages

▶NVDmozilla/firefox< 136.0
▶CVEListV5mozilla/firefox_for_iosunspecified — 136

🔴Vulnerability Details

3
OSV
CVE-2025-27424: Websites redirecting to a non-HTTP scheme URL could allow a website address to be spoofed for a malicious page This vulnerability affects Firefox for↗2025-03-04
▶
GHSA
GHSA-m2rp-964h-h237: Websites redirecting to a non-HTTP scheme URL could allow a website address to be spoofed for a malicious page This vulnerability affects Firefox for↗2025-03-04
▶
CVEList
CVE-2025-27424: Websites redirecting to a non-HTTP scheme URL could allow a website address to be spoofed for a malicious page This vulnerability affects Firefox for↗2025-03-04
▶

📋Vendor Advisories

3
Red Hat
diffusers: Hugging Face Diffusers: Remote Code Execution via Deserialization of Untrusted Data↗2025-12-23
▶
Debian
CVE-2025-27424: firefox - Websites redirecting to a non-HTTP scheme URL could allow a website address to b...↗2025
▶
Mozilla
Mozilla Foundation Security Advisory 2025-13: CVE-2025-27424↗
▶
CVE-2025-27424 (MEDIUM CVSS 4.3) | Websites redirecting to a non-HTTP | cvebase.io