CVE-2025-11720: Spoofing risk in Android custom tabs
The Firefox and Firefox Focus UI for the Android custom tab feature only showed the "site" that was loaded, not the full hostname. User supplied content hosted on a subdomain of a site could have been used to fool a user into thinking it was content from a different subdomain of that site.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 144 - Upgrade
Upgrade
Firefox and Firefox Focus for Androidto a version that resolves this vulnerability.Fixed in 144
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-11720?
CVE-2025-11720 is classified as a moderate severity vulnerability.
How do I fix CVE-2025-11720?
To fix CVE-2025-11720, update Firefox and Firefox Focus to version 144 or later.
What type of vulnerability is CVE-2025-11720?
CVE-2025-11720 is a UI spoofing vulnerability affecting Firefox and Firefox Focus on Android.
What could be the impact of CVE-2025-11720?
The impact of CVE-2025-11720 is that attackers could mislead users by displaying incorrect subdomain information.
Which versions of Firefox are affected by CVE-2025-11720?
Firefox versions prior to 144 are affected by CVE-2025-11720.