by Kastro
Paper/Archive/CVE-2025-54143

CVE-2025-54143

Mozilla Firefox for iOS — Sandboxed iframes could allow local downloads despite sandbox restrictions

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
38
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 41.5.415 × 208.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Sandboxed iframes on webpages could potentially allow downloads to the device, bypassing the expected sandbox restrictions declared on the parent page. This vulnerability was fixed in Firefox for iOS 141.

Affected

ProductAffectedFixed inSource
Firefox for iOSsee advisory141CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refbugzilla.mozilla.org/show_bug.cgi?id=1912671refmozilla.org/security/advisories/mfsa2025-60