CVE-2025-5020: Links using non-HTTP schemes opened from other apps such as Safari could have allowed spoofing of website addresses
Opening maliciously-crafted URLs in Firefox from other apps such as Safari could have allowed attackers to spoof website addresses if the URLs utilized non-HTTP schemes used internally by the Firefox iOS client
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Firefox for iOSto a version that resolves this vulnerability.Fixed in 139
Event History
Frequently Asked Questions
What is the severity of CVE-2025-5020?
CVE-2025-5020 has been classified as a medium severity vulnerability due to the potential for spoofed website addresses.
How do I fix CVE-2025-5020?
To mitigate CVE-2025-5020, update Firefox for iOS to version 139 or higher.
What types of attacks are possible with CVE-2025-5020?
CVE-2025-5020 allows attackers to spoof website addresses through maliciously-crafted URLs.
Which versions of Firefox for iOS are affected by CVE-2025-5020?
CVE-2025-5020 affects all versions of Firefox for iOS prior to version 139.
What should users do if they are using an affected version of Firefox for iOS?
Users should immediately update to Firefox for iOS version 139 or newer to avoid exploitation of CVE-2025-5020.