CVE-2025-11720: Spoofing risk in Android custom tabs
Published Oct 14, 2025
·Updated
The Firefox and Firefox Focus UI for the Android custom tab feature only showed the "site" that was loaded, not the full hostname. User supplied content hosted on a subdomain of a site could have been used to fool a user into thinking it was content from a different subdomain of that site.
Affected Software
3 affected componentsFixes available
Mozilla Firefox<144
144
All of the following
Mozilla Firefox<144.0
Google Android
Event History
Oct 14, 2025
CVE Published
via Mozilla·12:00 AM
Data Sourced
via Mozilla·12:00 AM
DescriptionSeverityAffected Software
CVE Published
via MITRE·12:27 PM
Data Sourced
via MITRE·12:27 PM
Description
Data Sourced
via NVD·01:15 PM
DescriptionSeverityWeaknessAffected Software
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
1
What is the severity of CVE-2025-11720?
CVE-2025-11720 is classified as a moderate severity vulnerability.
2
How do I fix CVE-2025-11720?
To fix CVE-2025-11720, update Firefox and Firefox Focus to version 144 or later.
3
What type of vulnerability is CVE-2025-11720?
CVE-2025-11720 is a UI spoofing vulnerability affecting Firefox and Firefox Focus on Android.
4
What could be the impact of CVE-2025-11720?
The impact of CVE-2025-11720 is that attackers could mislead users by displaying incorrect subdomain information.
5
Which versions of Firefox are affected by CVE-2025-11720?
Firefox versions prior to 144 are affected by CVE-2025-11720.