by Kastro
Paper/Archive/CVE-2025-55031

CVE-2025-55031

Mozilla Firefox for iOS — Passkey phishing within Bluetooth range

EPSS 0.4%CVSS 9.8
critical.is priorityof 100
37
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 37.4.374 × 207.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Malicious pages could use Firefox for iOS to pass FIDO: links to the OS and trigger the hybrid passkey transport. An attacker within Bluetooth range could have used this to trick the user into using their passkey to log the attacker's computer into the target account. This vulnerability was fixed in Firefox for iOS 142 and Focus for iOS 142.

Affected

ProductAffectedFixed inSource
Firefox for iOSsee advisory142CNA
Focus for iOSsee advisory142CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refbugzilla.mozilla.org/show_bug.cgi?id=1979499refbugzilla.mozilla.org/show_bug.cgi?id=1979804refmozilla.org/security/advisories/mfsa2025-68refmozilla.org/security/advisories/mfsa2025-69