CVE-2025-10530 Overview
CVE-2025-10530 is a spoofing vulnerability in the Web Authentication (WebAuthn) component of Mozilla Firefox for Android. The flaw allows a remote attacker to present misleading authentication context to users during WebAuthn ceremonies. Mozilla fixed the issue in Firefox 143 and Thunderbird 143. The weakness is classified as [CWE-290] Authentication Bypass by Spoofing. The vulnerability affects mobile users relying on WebAuthn for passwordless or multi-factor authentication.
Critical Impact
Attackers can spoof WebAuthn authentication context on Firefox for Android, potentially tricking users into approving credential operations for attacker-controlled origins and undermining phishing-resistant authentication guarantees.
Affected Products
- Mozilla Firefox for Android prior to version 143
- Mozilla Thunderbird prior to version 143
- Deployments relying on WebAuthn for authentication on affected Mozilla clients
Discovery Timeline
- 2025-09-16 - CVE-2025-10530 published to the National Vulnerability Database
- 2025-09-16 - Mozilla publishes advisories MFSA-2025-73 and MFSA-2025-77
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-10530
Vulnerability Analysis
The vulnerability resides in the WebAuthn component of Firefox for Android. WebAuthn is the W3C standard implemented in browsers to support public-key authentication with FIDO2 authenticators. The specification depends on the browser accurately conveying the Relying Party (RP) identity and origin to the user and the authenticator. In the affected Firefox for Android builds, this trust context can be spoofed, breaking the origin-binding assumption that makes WebAuthn phishing-resistant.
Because the attack proceeds over the network without user interaction beyond normal browsing, an attacker only needs to lure a victim to a crafted page. The impact is limited to confidentiality and integrity of the authentication ceremony rather than full account takeover through code execution.
Root Cause
The root cause is improper enforcement of the origin or user-visible context during a WebAuthn ceremony in the Android build of Firefox. Under [CWE-290], the browser accepts or displays authentication metadata that a remote party can influence, allowing the user or authenticator to interpret the request as coming from a legitimate Relying Party.
Attack Vector
An attacker hosts a malicious web page that initiates a WebAuthn navigator.credentials.get() or create() call while manipulating the presentation of the Relying Party context. When a victim visits the page in a vulnerable Firefox for Android build, the browser conveys misleading origin information, enabling credential registration or assertion flows against an attacker-controlled destination. See the Mozilla Bug Report #1974025 for technical details tied to the fix.
Detection Methods for CVE-2025-10530
Indicators of Compromise
- Firefox for Android clients reporting User-Agent versions below Firefox/143 in web server logs
- Unexpected WebAuthn registration or assertion events originating from mobile Firefox sessions on unfamiliar domains
- Access logs showing WebAuthn endpoints (/webauthn/*, /.well-known/webauthn) accessed immediately after redirects from newly registered lookalike domains
Detection Strategies
- Inventory installed Firefox and Thunderbird versions across managed mobile and desktop endpoints and flag builds below 143.
- Correlate identity provider WebAuthn logs with browser fingerprint data to identify assertions from vulnerable Firefox for Android versions.
- Monitor for phishing infrastructure using domains that visually resemble Relying Party identifiers registered with the identity provider.
Monitoring Recommendations
- Enable authentication anomaly monitoring in the identity provider for new WebAuthn credentials registered from mobile browsers.
- Alert on FIDO2 assertions originating from user agents matching outdated Firefox for Android releases.
- Track outbound DNS and HTTP requests to newly observed domains combined with WebAuthn API usage from mobile clients.
How to Mitigate CVE-2025-10530
Immediate Actions Required
- Update Firefox for Android to version 143 or later through Google Play or enterprise mobile device management.
- Update Thunderbird to version 143 or later on all desktop endpoints.
- Communicate to users that WebAuthn prompts on mobile Firefox should be treated with caution until updates are confirmed.
Patch Information
Mozilla addressed the issue in Firefox 143 and Thunderbird 143. Refer to the Mozilla Security Advisory MFSA-2025-73 and the Mozilla Security Advisory MFSA-2025-77 for authoritative fix details and affected version ranges.
Workarounds
- Use an alternative up-to-date browser on Android for WebAuthn-protected sign-ins until Firefox is patched.
- Enforce a minimum browser version policy at the identity provider to reject WebAuthn ceremonies from Firefox for Android versions earlier than 143.
- Require step-up authentication or device attestation for high-value operations while the fleet is being upgraded.
# Configuration example: enforce minimum Firefox version via MDM (Android Enterprise)
# Deploy Firefox 143+ as a managed app and block older versions
adb shell pm list packages | grep org.mozilla.firefox
adb shell dumpsys package org.mozilla.firefox | grep versionName
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
