CVE-2025-55030: Mozilla Firefox for iOS XSS Vulnerability

CVE-2025-55030 Overview

CVE-2025-55030 affects Firefox for iOS versions prior to 142. The browser fails to respect the Content-Disposition: attachment HTTP response header. Instead of prompting a download, Firefox for iOS renders the content inline within the browser context. This behavior allows attacker-controlled files served with attachment disposition to execute in the origin of the serving site. The flaw creates a path for Cross-Site Scripting (XSS) against web applications that rely on Content-Disposition as a defense against inline rendering of user-uploaded content. Mozilla addressed the issue in Firefox for iOS 142 and documented it in advisory MFSA-2025-68.

Critical Impact
Attacker-uploaded HTML or script content served with Content-Disposition: attachment executes inline in Firefox for iOS, enabling XSS against the hosting origin.

Affected Products

Mozilla Firefox for iOS versions prior to 142
Applications relying on Content-Disposition: attachment for XSS mitigation when accessed by Firefox for iOS
iOS devices running vulnerable Firefox builds

Discovery Timeline

2025-08-19 - CVE-2025-55030 published to the National Vulnerability Database
2025-08-19 - Mozilla Security Advisory MFSA-2025-68 released with fix in Firefox for iOS 142
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-55030

Vulnerability Analysis

The vulnerability is a client-side input handling failure classified under [CWE-640]. When a server returns a resource with the Content-Disposition: attachment header, browsers are expected to trigger a download rather than render the response body. Firefox for iOS ignored this directive and rendered the response inline. If the response body contains HTML or JavaScript, the browser executes it in the security context of the hosting origin. This defeats a common server-side XSS mitigation used by file hosting services, webmail, and any application that accepts user-uploaded content. The CWE-640 classification reflects the browser's failure to enforce a security-relevant response header that governs how content is presented to the user.

Root Cause

The root cause is missing enforcement of the Content-Disposition response header parsing logic on the iOS build of Firefox. The browser processed the response body according to its Content-Type rather than honoring the attachment disposition. Because Firefox for iOS is built on WebKit due to Apple platform restrictions, the disposition handling diverges from desktop Firefox builds.

Attack Vector

An attacker uploads a crafted HTML file to a target application that accepts user content and serves it with Content-Disposition: attachment as an XSS defense. The attacker then sends a victim using Firefox for iOS a link to the uploaded resource. Firefox renders the HTML inline, executing the attacker's JavaScript in the origin of the hosting application. The attacker can then read cookies, session tokens, or perform actions as the victim. User interaction is required — the victim must click the link — which aligns with the reported attack complexity.

No public proof-of-concept code is available. See the Mozilla Bug Report #1976304 for additional technical context.

Detection Methods for CVE-2025-55030

Indicators of Compromise

Web server logs showing requests from iOS Firefox user-agent strings retrieving user-uploaded HTML, SVG, or script files served with Content-Disposition: attachment
Unexpected session activity following user access to file download links on user-content domains
Outbound requests from application origins to attacker-controlled endpoints correlating with file download URLs

Detection Strategies

Inventory Firefox for iOS installations across managed mobile devices and identify versions below 142
Review application access logs for downloads of attacker-uploadable content types such as .html, .htm, .svg, and .xhtml
Correlate authentication events with prior downloads of user-hosted content to identify potential session theft

Monitoring Recommendations

Monitor mobile device management (MDM) inventory for Firefox for iOS version compliance
Alert on uploads of HTML or script content to file storage endpoints intended for non-executable files
Track anomalous cross-origin requests originating from user-content subdomains

How to Mitigate CVE-2025-55030

Immediate Actions Required

Update Firefox for iOS to version 142 or later through the Apple App Store
Enforce minimum Firefox for iOS version 142 via MDM policy on managed devices
Audit web applications that rely on Content-Disposition: attachment for XSS defense and add defense-in-depth controls

Patch Information

Mozilla resolved the issue in Firefox for iOS 142. Refer to the Mozilla Security Advisory MFSA-2025-68 for release details. Users should install the update through the Apple App Store. No configuration changes are required after updating.

Workarounds

Serve user-uploaded content from a separate, sandboxed origin distinct from the main application domain
Set Content-Security-Policy: sandbox alongside Content-Disposition: attachment to block script execution even if the disposition is ignored
Restrict uploaded file types and reject HTML, SVG, and other renderable formats where feasible
Use an alternate browser on iOS until Firefox is updated to version 142

bash

# Nginx defense-in-depth configuration for user-uploaded content
location /user-uploads/ {
    add_header Content-Disposition "attachment";
    add_header Content-Security-Policy "sandbox; default-src 'none'";
    add_header X-Content-Type-Options "nosniff";
    add_header X-Frame-Options "DENY";
}