CVE-2025-11716: Sandboxed iframes allowed links to open in external apps (Android only)
Links in a sandboxed iframe could open an external app on Android without the required "allow-" permission. This vulnerability was fixed in Firefox 144 and Thunderbird 144.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 144 - Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 159.0-1 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 144 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 144
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-11716?
CVE-2025-11716 has been classified as a moderate severity vulnerability.
How do I fix CVE-2025-11716?
To fix CVE-2025-11716, update Firefox or Thunderbird to version 144 or later.
What systems are affected by CVE-2025-11716?
CVE-2025-11716 affects Firefox versions prior to 144 and Thunderbird versions prior to 144.
How does CVE-2025-11716 impact users?
CVE-2025-11716 allows links within sandboxed iframes to open external applications without the required permissions, posing security risks.
Was there a fix released for CVE-2025-11716?
Yes, a fix for CVE-2025-11716 was included in the release of Firefox and Thunderbird version 144.