CVE-2025-5020 — Improper Authorization in Handler for Custom URL Scheme in Mozilla Firefox
Severity
4.3MEDIUMNVD
EPSS
0.2%
top 60.21%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMay 21
Description
Opening maliciously-crafted URLs in Firefox from other apps such as Safari could have allowed attackers to spoof website addresses if the URLs utilized non-HTTP schemes used internally by the Firefox iOS client. This vulnerability was fixed in Firefox for iOS 139.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4
Affected Packages1 packages
🔴Vulnerability Details
3GHSA▶
GHSA-7mfw-wgr7-m3jg: Opening maliciously-crafted URLs in Firefox from other apps such as Safari could have allowed attackers to spoof website addresses if the URLs utilize↗2025-05-21
OSV▶
CVE-2025-5020: Opening maliciously-crafted URLs in Firefox from other apps such as Safari could have allowed attackers to spoof website addresses if the URLs utilize↗2025-05-21
CVEList▶
Links using non-HTTP schemes opened from other apps such as Safari could have allowed spoofing of website addresses↗2025-05-21