CVE-2025-5020: Links using non-HTTP schemes opened from other apps such as Safari could have allowed spoofing of website addresses

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-05-21 · updated 2026-10-05
Weakness: CWE-939

Description

Opening maliciously-crafted URLs in Firefox from other apps such as Safari could have allowed attackers to spoof website addresses if the URLs utilized non-HTTP schemes used internally by the Firefox iOS client. This vulnerability was fixed in Firefox for iOS 139.

Affected products

Mozilla Firefox: before 139.0 — fixed in 139.0

How to fix

Upgrade to a fixed version: Mozilla Firefox 139.0. Check the vendor advisory for mitigations.

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1951558
https://www.mozilla.org/security/advisories/mfsa2025-39/

Get alerted when CVE-2025-5020 or the next vulnerability affects your stack