Download Initiation Vulnerability in Firefox for Android
CVE-2025-8042

9.8CRITICAL

Key Information:

Vendor

Mozilla
Status
Firefox
Vendor
CVE Published:
19 August 2025

What is CVE-2025-8042?

A vulnerability in Firefox for Android allows a sandboxed iframe to initiate downloads without the necessary permissions. This issue affects versions of the browser prior to 141, potentially leading users to unintentionally download malicious files. The absence of the 'allow-downloads' attribute in the iframe creates a security gap that can be exploited by attackers, emphasizing the need for users to update their browsers and remain protected against such risks.

Affected Version(s)

Firefox < 141

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1791322
https://www.mozilla.org/security/advisories/mfsa2025-56/

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Axel Chong (@Haxatron)
.
CVE-2025-8042 : Download Initiation Vulnerability in Firefox for Android