CVE-2025-1935: Clickjacking the registerProtocolHandler info-bar
A web page could trick a user into setting that site as the default handler for a custom URL protocol. This vulnerability was fixed in Firefox 136, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8.
Other sources
A web page could trick a user into setting that site as the default handler for a custom URL protocol. This vulnerability affects Firefox < 136 and Firefox ESR < 128.8.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 136 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 128.8 - Upgrade
Upgrade
ubuntu/firefoxto a version that resolves this vulnerability.Fixed in 136.0+build3-0ubuntu0.20.04.1 - Upgrade
Upgrade
ubuntu/thunderbirdto a version that resolves this vulnerability.Fixed in 1:128.12.0+build1-0ubuntu0.22.04.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 136 - Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 159.0.1-1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 140.12.0esr-1~deb12u1Fixed in 153.6.0esr-1~deb12u2Fixed in 140.15.0esr-1~deb13u1Fixed in 153.6.0esr-1~deb13u1Fixed in 153.5.1esr-1Fixed in 153.6.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:140.12.0esr-1~deb12u1Fixed in 1:153.6.0esr-1~deb12u2Fixed in 1:140.12.0esr-1~deb13u1Fixed in 1:153.6.0esr-1~deb13u1Fixed in 1:153.5.0esr-1Fixed in 1:153.6.0esr-1 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 136 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 128.8 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 128.8
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-1935?
CVE-2025-1935 is considered a medium severity vulnerability due to its potential to manipulate user settings.
How do I fix CVE-2025-1935?
To resolve CVE-2025-1935, update your Firefox to version 136 or Firefox ESR to version 128.8.
Which versions of Firefox are affected by CVE-2025-1935?
CVE-2025-1935 affects Firefox versions prior to 136 and Firefox ESR versions prior to 128.8.
What type of attack does CVE-2025-1935 represent?
CVE-2025-1935 represents a social engineering attack that can change the default URL protocol handler.
Is CVE-2025-1935 restricted to specific operating systems?
CVE-2025-1935 affects the Firefox browser on multiple operating systems including Windows, macOS, and Linux.