Sandboxed Iframe Vulnerability in Firefox and Thunderbird by Mozilla

CVE-2025-11716

What is CVE-2025-11716?

A vulnerability exists in Firefox and Thunderbird that allows links within a sandboxed iframe to launch external applications on Android devices without requiring the necessary 'allow-' permission. This can potentially lead to unauthorized actions and data exposure, raising significant security concerns for users running affected versions of the software.

References