CVE-2025-11716 Overview
CVE-2025-11716 is a sandbox escape vulnerability affecting Mozilla Firefox and Thunderbird on Android. Links inside a sandboxed <iframe> can trigger an external Android application without the required allow- permission token. The flaw bypasses the HTML5 iframe sandbox model, which is designed to restrict navigation and cross-origin actions. Mozilla addressed the issue in Firefox 144 and Thunderbird 144. The vulnerability is categorized under [CWE-284] Improper Access Control and requires user interaction to trigger the external application launch.
Critical Impact
Attackers can invoke arbitrary Android applications from a sandboxed iframe, bypassing sandbox restrictions and enabling cross-app attack chains, deep-link abuse, and integrity impact on the mobile device.
Affected Products
- Mozilla Firefox on Android (versions prior to 144)
- Mozilla Thunderbird (versions prior to 144)
- Google Android platform (as the host operating system)
Discovery Timeline
- 2025-10-14 - CVE-2025-11716 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-11716
Vulnerability Analysis
The HTML5 iframe sandbox attribute restricts embedded content by default. Developers must explicitly grant capabilities using tokens such as allow-popups, allow-top-navigation, or allow-popups-to-escape-sandbox. On Firefox for Android, this enforcement path did not correctly intercept navigations that resolved to Android intent handlers or custom URI schemes registered by external applications. A link inside a sandboxed iframe could therefore trigger an external app launch without any allow- permission being granted by the embedder. The issue affects the same code paths shared with Thunderbird on Android platforms.
Root Cause
The root cause is improper access control [CWE-284] in the navigation logic that dispatches external application intents. Sandbox flag validation was applied to standard web navigations but was not enforced before handing a URL to the Android intent resolver. As a result, the sandbox context was effectively lost when the browser delegated URL handling to the operating system.
Attack Vector
Exploitation requires a victim to load an attacker-controlled page that embeds a sandboxed iframe, then click or otherwise interact with a link inside that frame. The link points to a scheme handled by an installed Android application. When activated, Firefox forwards the URL to Android without honoring the sandbox restrictions, causing the external application to launch with attacker-supplied parameters. This can be chained with deep-link vulnerabilities in third-party apps to escalate impact.
No verified public exploit code is available. Refer to Bugzilla Issue #1818679 for implementation-level detail once the ticket is made public.
Detection Methods for CVE-2025-11716
Indicators of Compromise
- Firefox for Android or Thunderbird on Android running versions earlier than 144 on managed mobile fleets.
- Web traffic logs showing pages that embed sandboxed iframes referencing non-HTTP schemes such as intent://, market://, or vendor custom schemes.
- Unexpected launches of external Android applications immediately following browser activity from untrusted origins.
Detection Strategies
- Inventory mobile browser versions through mobile device management (MDM) telemetry and flag Firefox or Thunderbird builds below 144.
- Inspect network proxy or DNS logs for pages delivering iframes with the sandbox attribute combined with links to app-invocation schemes.
- Correlate browser process events with subsequent Android intent activity to identify launches that lack a user-initiated top-level navigation.
Monitoring Recommendations
- Enable Mozilla's automatic update channel for Firefox and Thunderbird on all Android endpoints and alert on stalled updates.
- Track advisories MFSA-2025-81 and MFSA-2025-84 for related fixes and follow-up regressions.
- Monitor for user reports of unexpected app launches originating from web content, which is a behavioral signal of exploitation attempts.
How to Mitigate CVE-2025-11716
Immediate Actions Required
- Update Mozilla Firefox for Android to version 144 or later on every managed device.
- Update Mozilla Thunderbird to version 144 or later where deployed on Android.
- Push the update through MDM policy to enforce compliance and block outdated builds from enterprise resources.
Patch Information
Mozilla resolved the issue in Firefox 144 and Thunderbird 144. Full remediation details are published in Mozilla Security Advisory MFSA-2025-81 and Mozilla Security Advisory MFSA-2025-84. Apply the vendor patches rather than relying on runtime mitigations, since sandbox enforcement is a browser-internal control.
Workarounds
- Restrict browsing on Android to trusted origins until all endpoints are patched, using MDM web filtering policies.
- Advise users to avoid clicking links inside embedded frames on untrusted sites until the update is applied.
- Where feasible, disable or restrict deep-link handlers on sensitive Android applications to reduce the impact of unauthorized intent launches.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
