CVE-2025-0244
MediumCVSS 5.3Exploitation Probability (EPSS)
Very high risk94th percentile - higher than 94% of all known CVEs
Summary
When redirecting to an invalid protocol scheme, an attacker could spoof the address bar. *Note: This issue only affected Android operating systems. Other operating systems are unaffected.*. This vulnerability was fixed in Firefox 134.
Risk Assessment
An attacker could exploit the vulnerability for phishing by displaying a fake URL, potentially tricking users into visiting malicious sites.
Recommendation
Update Firefox on Android to version 134 or later.
Other vulnerabilities in Firefox
See all- CVE-2026-100832High
Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 140.17, Thunderbird 153.4, Firefox ESR 115.42, and Firefox ESR 140.17.
- CVE-2026-100831High
Use-after-free in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
- CVE-2026-100825High
Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
- CVE-2026-100824High
Privilege escalation vulnerability in the Places component. Fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
- CVE-2026-100820High
Privilege escalation vulnerability in the Address Bar component. Fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
- CVE-2026-100815High
Use-after-free vulnerability in the CSS Parsing and Computation component. Fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
- CVE-2026-100814High
Incorrect boundary conditions in the JavaScript Engine: JIT component. Fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
- CVE-2026-100813High
Invalid pointer in the JavaScript Engine: JIT component. Fixed in Thunderbird 157 and Firefox 157.
- CVE-2026-100807High
Privilege escalation vulnerability in the DOM: Service Workers component. Fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
- CVE-2026-100805High
Race condition and use-after-free vulnerability in the Audio/Video component. Fixed in Thunderbird 157 and Firefox 157.
Original NVD description (English source)
When redirecting to an invalid protocol scheme, an attacker could spoof the address bar. *Note: This issue only affected Android operating systems. Other operating systems are unaffected.*. This vulnerability was fixed in Firefox 134.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS