CVE-2025-1941Critical· 9.1▾ MidnightUnder certain circumstances, a user opt-in setting that Focus should require authentication before use could have been be bypassed (distinct from CVE-2025-0245). This vulnerability was fixed in Firefox 136.
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 50.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
Last analysed / modified upstream
Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been be bypassed (distinct from CVE-2025-0245). This vulnerability was fixed in Firefox 136.
firefox < 136.0Upgrade past the affected range:
firefox 136.0Connected by shared product, vendor, weakness, or advisory.
CVE-2025-1942Critical· 9.8When String.toUpperCase() caused a string to get longer it was possible for uninitialized memory to be incorporated into the result string
CVE-2025-1939Low· 3.9Android apps can load web pages using the Custom Tabs feature
CVE-2025-1934Medium· 6.5It was possible to interrupt the processing of a RegExp bailout and run additional JavaScript, potentially triggering garbage collection when the engine was not expecting it
CVE-2025-1935Medium· 4.3A web page could trick a user into setting that site as the default handler for a custom URL protocol
CVE-2025-1936High· 7.3jar: URLs retrieve local file content packaged in a ZIP archive
CVE-2025-1931High· 7.5It was possible to cause a use-after-free in the content process side of a WebTransport connection, leading to a potentially exploitable crash