CVE-2025-55031

Published: Aug 19, 2025Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Malicious pages could use Firefox for iOS to pass FIDO: links to the OS and trigger the hybrid passkey transport. An attacker within Bluetooth range could have used this to trick the user into using their passkey to log the attacker's computer into the target account. This vulnerability was fixed in Firefox for iOS 142 and Focus for iOS 142.

Affected (2)

Products: Mozilla: Firefox, Firefox Focus

2 products

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox	Before 142.0
Mozilla Firefox Focus	Before 142.0

Related CWEs

URL Redirection to Untrusted Site ('Open Redirect')

A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.

References (4)

https://bugzilla.mozilla.org/show_bug.cgi?id=1979499

Source: security@mozilla.org

Issue TrackingPermissions Required

https://bugzilla.mozilla.org/show_bug.cgi?id=1979804

Source: security@mozilla.org

Issue TrackingPermissions Required

https://www.mozilla.org/security/advisories/mfsa2025-68/

Source: security@mozilla.org

Vendor Advisory

https://www.mozilla.org/security/advisories/mfsa2025-69/

Source: security@mozilla.org

Vendor Advisory

Timeline

No history available yet.