CVE-2025-54143: Sandboxed iframes on webpages could potentially allow downloads to the device, bypassing the expected sandbox restrictions declared on the parent page. This…

critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

Sandboxed iframes on webpages could potentially allow downloads to the device, bypassing the expected sandbox restrictions declared on the parent page. This vulnerability was fixed in Firefox for iOS 141.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
mozilla	firefox	< 141.0	141.0
mozilla	firefox	—	—

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

osv9.8CRITICAL