CVE-2025-8042
published 2025-08-19CVE-2025-8042: Firefox for Android allowed a sandboxed iframe without the `allow-downloads` attribute to start downloads. This vulnerability was fixed in Firefox 141.
PriorityP342critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.47%
40.1th percentile
Firefox for Android allowed a sandboxed iframe without the `allow-downloads` attribute to start downloads. This vulnerability was fixed in Firefox 141.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | firefox | — | — |
| mozilla | firefox | < 141.0 | 141.0 |
| mozilla | firefox | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_debian9.8LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2025-8042: firefox - Firefox for Android allowed a sandboxed iframe without the `allow-downloads` att...
vendor_debian·2025·CVSS 9.8
CVE-2025-8042 [CRITICAL] CVE-2025-8042: firefox - Firefox for Android allowed a sandboxed iframe without the `allow-downloads` att...
Firefox for Android allowed a sandboxed iframe without the `allow-downloads` attribute to start downloads. This vulnerability affects Firefox < 141.
Scope: local
sid: resolved
Mozilla
Mozilla Foundation Security Advisory 2025-56: CVE-2025-8042
vendor_mozilla·CVSS 9.8
CVE-2025-8042 [CRITICAL] Mozilla Foundation Security Advisory 2025-56: CVE-2025-8042
Mozilla Foundation Security Advisory 2025-56
CVE: CVE-2025-8042
Product: Firefox
Impact: high
Fixed in: Firefox 141
VulDB
Mozilla Firefox up to 140 on Android iFrame access control (EUVD-2025-25232)
vuldb·2026-10-01·CVSS 9.8
CVE-2025-8042 [CRITICAL] Mozilla Firefox up to 140 on Android iFrame access control (EUVD-2025-25232)
A vulnerability was found in Mozilla Firefox up to 140 on Android and classified as critical. Impacted is an unknown function of the component iFrame Handler. The manipulation results in improper access controls.
This vulnerability was named CVE-2025-8042. The attack may be performed from remote. There is no available exploit.
It is suggested to upgrade the affected component.
GHSA
GHSA-86q6-8hr2-487f: Firefox for Android allowed a sandboxed iframe without the `allow-downloads` attribute to start downloads
ghsa_unreviewed·2025-08-19
CVE-2025-8042 [CRITICAL] CWE-732 GHSA-86q6-8hr2-487f: Firefox for Android allowed a sandboxed iframe without the `allow-downloads` attribute to start downloads
Firefox for Android allowed a sandboxed iframe without the `allow-downloads` attribute to start downloads. This vulnerability affects Firefox < 141.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-08-19
Published