Sandboxed Iframe Vulnerability in Firefox and Thunderbird by Mozilla
CVE-2025-11716

6.5MEDIUM

Key Information:

Vendor

Mozilla
Status
Firefox
Thunderbird
Vendor
CVE Published:
14 October 2025

What is CVE-2025-11716?

A vulnerability exists in Firefox and Thunderbird that allows links within a sandboxed iframe to launch external applications on Android devices without requiring the necessary 'allow-' permission. This can potentially lead to unauthorized actions and data exposure, raising significant security concerns for users running affected versions of the software.

Affected Version(s)

Firefox < 144

Thunderbird < 144

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1818679
https://www.mozilla.org/security/advisories/mfsa2025-81/
https://www.mozilla.org/security/advisories/mfsa2025-84/

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Axel Chong (@Haxatron)
JSON
.