CVE-2025-1939

EUVD-2025-6162
Android apps can load web pages using the Custom Tabs feature. This feature supports a transition animation that could have been used to trick a user into granting sensitive permissions by hiding what the user was actually clicking. This vulnerability was fixed in Firefox 136.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
mozillaCNA
3.9 LOW
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 7.78%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
mozillafirefox
𝑥
< 136.0
CNA
Debian logo
Debian Releases
Debian Product
Codename
firefox
sid
157.0.1-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
firefox
focal
dne
jammy
not-affected
noble
not-affected
oracular
not-affected
plucky
not-affected
thunderbird
focal
dne
jammy
not-affected
noble
not-affected
oracular
not-affected
plucky
not-affected
Common Weakness Enumeration
References
https://bugzilla.mozilla.org/show_bug.cgi?id=1928334
https://www.mozilla.org/security/advisories/mfsa2025-14/
https://taptrap.click