CVE-2025-1939Low· 3.9▾ SunlitAndroid apps can load web pages using the Custom Tabs feature. This feature supports a transition animation that could have been used to trick a user into granting sensitive permissions by hiding what the user was actually clicking. This…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 21.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
Android apps can load web pages using the Custom Tabs feature. This feature supports a transition animation that could have been used to trick a user into granting sensitive permissions by hiding what the user was actually clicking. This vulnerability was fixed in Firefox 136.
firefox < 136.0Upgrade past the affected range:
firefox 136.0Connected by shared product, vendor, weakness, or advisory.
CVE-2025-10859Medium· 4.0Cookie storage for non-HTML temporary documents was being shared incorrectly with normal browsing content, allowing information from private tabs to escape Incognito mode even after the user closed all tabs
CVE-2025-1942Critical· 9.8When String.toUpperCase() caused a string to get longer it was possible for uninitialized memory to be incorporated into the result string
CVE-2025-1941Critical· 9.1Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been be bypassed (distinct from CVE-2025-0245)
CVE-2025-1934Medium· 6.5It was possible to interrupt the processing of a RegExp bailout and run additional JavaScript, potentially triggering garbage collection when the engine was not expecting it
CVE-2025-1935Medium· 4.3A web page could trick a user into setting that site as the default handler for a custom URL protocol
CVE-2025-1936High· 7.3jar: URLs retrieve local file content packaged in a ZIP archive