SB2025011102 - Multiple vulnerabilities in Firefox for iOS

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Spoofing attack (CVE-ID: CVE-2025-23108)

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to an error when handling JavaScript links. A remote attacker can trick the victim into opening Javascript links in a new tab via long-press in the Firefox iOS client and spoof the URL of the new tab.

2) Spoofing attack (CVE-ID: CVE-2025-23109)

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to incorrect processing of long hostnames. A remote attacker can use a long hostname to obscure the actual host of the website or spoof the website address.

Remediation

Install update from vendor's website.

References

• https://www.mozilla.org/en-US/security/advisories/mfsa2025-06/
• https://bugzilla.mozilla.org/show_bug.cgi?id=1933172
• https://bugzilla.mozilla.org/show_bug.cgi?id=1419275