CVE-2025-23108: Mozilla Firefox iOS XSS Vulnerability

CVE-2025-23108 Overview

CVE-2025-23108 is a URL spoofing vulnerability in Mozilla Firefox for iOS. The flaw allows a malicious script to spoof the URL displayed in a new tab when a user long-presses a JavaScript link and opens it in a new tab. Mozilla resolved the issue in Firefox for iOS 134 and tracked it under advisory MFSA-2025-06. The vulnerability is categorized under [CWE-79] (Improper Neutralization of Input During Web Page Generation) and requires user interaction to trigger.

Critical Impact
Attackers can spoof the address bar URL in Firefox for iOS, enabling phishing attacks in which victims believe they are visiting a trusted site while executing attacker-controlled JavaScript.

Affected Products

Mozilla Firefox for iOS prior to version 134
iPhone OS platform installations of Firefox
Mobile browsers relying on the affected Firefox iOS builds

Discovery Timeline

2025-01-11 - CVE-2025-23108 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-23108

Vulnerability Analysis

The vulnerability resides in how Firefox for iOS handles the long-press context menu action on links using the javascript: scheme. When a user long-presses such a link and selects the option to open it in a new tab, the browser fails to correctly reconcile the URL shown in the address bar with the actual script execution context. This mismatch allows a malicious page to display an arbitrary URL — for example, a well-known banking domain — while executing attacker-controlled JavaScript in the newly opened tab.

The issue falls under the [CWE-79] classification because content controlled by an attacker influences the rendered page context without proper neutralization. The impact is limited to integrity of the browser UI and the trust boundary between the address bar and the executing script.

Root Cause

The root cause is improper handling of the deferred navigation state when a javascript: URL is promoted from a long-press gesture into a new tab. The address bar is populated from the source link metadata rather than the effective execution context, letting the attacker decouple the visible URL from the running script.

Attack Vector

Exploitation requires an attacker to lure a victim to a malicious webpage containing a crafted anchor element. The victim must perform a long-press gesture and select "Open in New Tab." The resulting tab displays a spoofed URL while executing the attacker's JavaScript payload, which can then present phishing content or credential prompts under the guise of a legitimate site.

No verified public proof-of-concept code is available. Refer to the Mozilla Bug Report #1933172 and the Mozilla Security Advisory MFSA-2025-06 for authoritative technical details.

Detection Methods for CVE-2025-23108

Indicators of Compromise

Web pages containing anchor tags with href="javascript:..." combined with target attributes that promote content into a new tab
Phishing landing pages accessed from Firefox for iOS clients running versions earlier than 134
User reports of legitimate-looking URLs in the address bar paired with unexpected credential prompts

Detection Strategies

Inspect proxy and web gateway logs for outbound requests from Firefox iOS user agents on versions prior to 134
Hunt for pages that combine javascript: URIs with UI content mimicking known brands in web content inspection tooling
Correlate mobile browser telemetry with reported phishing incidents originating from long-press link interactions

Monitoring Recommendations

Track Firefox for iOS version distribution across managed mobile devices using MDM inventory reports
Alert on user-reported phishing that references Firefox iOS as the browser of origin
Review email and messaging security logs for lures directing recipients to open links on mobile devices

How to Mitigate CVE-2025-23108

Immediate Actions Required

Update Firefox for iOS to version 134 or later through the Apple App Store on all managed and personal devices
Enforce minimum browser versions using mobile device management (MDM) compliance policies
Educate users to verify URLs by tapping the address bar and re-examining the domain after opening links in new tabs

Patch Information

Mozilla addressed CVE-2025-23108 in Firefox for iOS 134. Details are published in the Mozilla Security Advisory MFSA-2025-06. The corresponding tracking record is available in Mozilla Bug Report #1933172.

Workarounds

Avoid using the long-press "Open in New Tab" action on untrusted links until the browser is updated
Restrict use of Firefox for iOS versions below 134 through MDM app version policies
Configure secure web gateways to block known phishing domains and inspect mobile-targeted lures

bash

# Verify installed Firefox iOS version via MDM query (example: Jamf Pro API)
curl -s -u "$JAMF_USER:$JAMF_PASS" \
  "https://your.jamfcloud.com/JSSResource/mobiledeviceapplications/bundleid/org.mozilla.ios.Firefox" \
  | grep -E "<version>|<name>"