CVE-2025-6428Medium· 4.3▾ SunlitWhen a URL was provided in a link querystring parameter, Firefox for Android would follow that URL instead of the correct URL, potentially leading to phishing attacks. *This bug only affects Firefox for Android. Other versions of Firefox…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
When a URL was provided in a link querystring parameter, Firefox for Android would follow that URL instead of the correct URL, potentially leading to phishing attacks. This bug only affects Firefox for Android. Other versions of Firefox are unaffected.. This vulnerability was fixed in Firefox 140.
firefox < 140.0Upgrade past the affected range:
firefox 140.0Connected by shared product, vendor, weakness, or advisory.
CVE-2025-27424Medium· 4.3Websites redirecting to a non-HTTP scheme URL could allow a website address to be spoofed for a malicious page
CVE-2025-0244Medium· 5.3When redirecting to an invalid protocol scheme, an attacker could spoof the address bar
CVE-2023-29540Medium· 6.1Using a redirect embedded into <code>sourceMappingUrls</code> could allow for navigation to external protocol links in sandboxed iframes without <code>allow-top-navigation-to-custom-protocols</code>
CVE-2026-118008High· 8.8Privilege escalation in the DOM: Navigation component
CVE-2026-117999NoneRace condition in the IPC component
CVE-2026-117976NoneSite isolation issue in the DOM: Navigation component