Threat Investigation
Request a demo

CVE-2025-5020

Medium

Description

Opening maliciously-crafted URLs in Firefox from other apps such as Safari could have allowed attackers to spoof website addresses if the URLs utilized non-HTTP schemes used internally by the Firefox iOS client. This vulnerability was fixed in Firefox for iOS 139.

SeverityMedium
CVSS4.3
Exploit probability—
ProductMozilla Firefox
PublishedMay 21, 2025
First seenMay 21, 2025
Weakness typeCWE-939CWE-939

How to fix

Update
  • mozilla firefox139.0 or later

Affected products

ProductAffected versionsFixed in
mozilla firefoxv < 139.0139.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.