CVE-2025-10859: Mozilla Firefox Information Disclosure Flaw

CVE-2025-10859 Overview

CVE-2025-10859 is an information disclosure vulnerability in Firefox for iOS. Cookie storage for non-HTML temporary documents was shared incorrectly with normal browsing content. As a result, cookie data from private tabs could leak into standard browsing sessions even after the user closed all Incognito tabs. The flaw undermines the privacy boundary that separates Incognito mode from persistent browsing state. Mozilla addressed the issue in Firefox for iOS 143.1. The weakness is tracked under [CWE-359: Exposure of Private Personal Information to an Unauthorized Actor].

Critical Impact
Session cookies and identifiers created inside Incognito tabs can persist into the normal browsing profile, defeating user expectations of private browsing isolation.

Affected Products

Mozilla Firefox for iOS prior to version 143.1
iOS builds of Firefox that render non-HTML temporary documents
Users relying on Incognito mode on iPhone and iPad devices

Discovery Timeline

2025-09-30 - CVE-2025-10859 published to the National Vulnerability Database (NVD)
2025-09-30 - Mozilla Security Advisory MFSA-2025-79 released with fix in Firefox for iOS 143.1
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10859

Vulnerability Analysis

The vulnerability affects how Firefox for iOS scopes cookie storage for temporary documents that are not standard HTML content. Non-HTML documents such as downloaded files, PDFs, or media resources rendered within a temporary document context did not inherit the isolated cookie jar used for Incognito browsing. Instead, cookies generated or accessed during handling of these documents were written to the shared cookie store used by the default browsing profile.

Because the shared store persists across sessions, the leaked cookie state remained available even after the user closed every private tab. This behavior contradicts the privacy contract that Incognito mode advertises to users, in which browsing artifacts should be discarded when private sessions end. See Mozilla Bug Report #1684624 for the underlying tracking issue.

Root Cause

The root cause is improper container isolation in the iOS cookie management layer. Temporary document contexts for non-HTML content used the default WKHTTPCookieStore rather than the ephemeral cookie store bound to Incognito sessions. The scoping logic did not evaluate whether the parent tab was private before selecting the target store.

Attack Vector

Exploitation requires local interaction with the device. An attacker with access to the same browser instance, or code hosted on a site loaded during Incognito browsing, can observe cookie values that should have been discarded. A user who visits an attacker-controlled site during private browsing may find that session identifiers, tracking cookies, or authentication tokens tied to that visit are readable from later non-private sessions. Remote exploitation over the network is not required.

No verified public proof-of-concept code is available. See the Mozilla Security Advisory MFSA-2025-79 for vendor technical details.

Detection Methods for CVE-2025-10859

Indicators of Compromise

Presence of cookies in the standard Firefox for iOS profile that were set during Incognito sessions
Persistent tracking or session cookies from domains only visited in private tabs
Firefox for iOS versions earlier than 143.1 installed on managed devices

Detection Strategies

Inventory mobile devices through mobile device management (MDM) to identify Firefox for iOS builds prior to 143.1
Review browser telemetry or network egress logs for continued session activity to domains that were expected to be scoped to private browsing
Correlate authentication events with device browser versions to identify sessions established on vulnerable clients

Monitoring Recommendations

Track Firefox for iOS version distribution across the fleet and alert on installations below 143.1
Monitor authentication providers for session reuse patterns that indicate cookies persisted beyond their expected lifetime
Enable MDM reporting on browser application updates to confirm patch adoption

How to Mitigate CVE-2025-10859

Immediate Actions Required

Update Firefox for iOS to version 143.1 or later on all managed and personal devices
Instruct users to clear existing website data in Firefox for iOS after updating to purge any previously leaked cookies
Rotate high-value session tokens issued to users who relied on Incognito mode for sensitive workflows

Patch Information

Mozilla fixed CVE-2025-10859 in Firefox for iOS 143.1. Details are published in Mozilla Security Advisory MFSA-2025-79. The underlying implementation change is tracked in Mozilla Bug Report #1684624. Update through the Apple App Store or via MDM-driven application deployment.

Workarounds

Avoid opening non-HTML documents such as PDFs or downloaded files inside Incognito tabs until the update is applied
Manually clear all website data and cookies from Firefox for iOS after any private browsing session
Use an alternative browser configured with a strict private mode until Firefox for iOS 143.1 is deployed

bash

# Verify installed Firefox for iOS version via MDM query (example)
mdm query --app org.mozilla.ios.Firefox --field CFBundleShortVersionString
# Expected output: 143.1 or higher