Skip to main content
Stopping PHP2SHELL: How SentinelOne Protects Customers From This Attack TechniqueRead More
Vulnerability Database/CVE-2025-55031

CVE-2025-55031: Firefox for iOS Auth Bypass Vulnerability

CVE-2025-55031 is an authentication bypass flaw in Firefox for iOS that allows attackers within Bluetooth range to hijack passkey authentication. This article covers technical details, affected versions, and mitigations.

Updated:

CVE-2025-55031 Overview

CVE-2025-55031 affects Mozilla Firefox for iOS and Focus for iOS. Malicious web pages could abuse the browsers to pass FIDO: URI scheme links to the operating system. This action triggered the hybrid passkey transport flow without sufficient user validation. An attacker within Bluetooth range could exploit this behavior to coerce a user into authenticating the attacker's computer to the target account. Mozilla addressed the issue in Firefox for iOS 142 and Focus for iOS 142. The flaw is categorized as a URL redirection to untrusted site issue [CWE-601].

Critical Impact

An attacker in Bluetooth proximity can hijack a victim's passkey to log into the victim's accounts from the attacker's device.

Affected Products

  • Mozilla Firefox for iOS (versions prior to 142)
  • Mozilla Focus for iOS (versions prior to 142)
  • iOS platform builds referenced by cpe:2.3:a:mozilla:firefox:*:*:*:*:*:iphone_os:*:*

Discovery Timeline

  • 2025-08-19 - CVE-2025-55031 published to NVD
  • 2026-04-13 - Last updated in NVD database

Technical Details for CVE-2025-55031

Vulnerability Analysis

The vulnerability lives in how Firefox for iOS and Focus for iOS handle FIDO: scheme links from web content. When a page contains a FIDO: link, the browser passes the URI to iOS without confirming the user's intent. iOS interprets the URI as a hybrid passkey transport request, which initiates Bluetooth Low Energy proximity authentication with a nearby authenticator-relying party pair. The user sees a system passkey prompt that appears to be legitimate. The Web Authentication (WebAuthn) hybrid transport was designed to bridge a phone with a desktop browser, but the trust assumption depends on the user initiating that flow. Passing the link silently through the browser breaks that assumption.

Root Cause

The root cause is improper input validation of URI schemes within the iOS browser navigation handler. Firefox for iOS did not block or gate the FIDO: scheme when invoked from arbitrary web content. The browser deferred handling to the operating system without prompting the user to confirm a passkey ceremony.

Attack Vector

An attacker hosts a malicious page and lures the victim to visit it in Firefox for iOS or Focus for iOS. The page triggers navigation to a crafted FIDO: link that encodes the attacker's pairing data. The victim's device begins a hybrid passkey transport over Bluetooth with the attacker's computer, which is positioned within Bluetooth range and is mid-login on a target service. If the victim approves the system passkey prompt, the attacker's session is authenticated as the victim. Refer to the Mozilla Security Advisory MFSA-2025-68 and Mozilla Security Advisory MFSA-2025-69 for vendor details.

Detect Identity Attacks the Moment Authentication Fails

Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.

Stop Identity Attacks

Detection Methods for CVE-2025-55031

Indicators of Compromise

  • Mobile device telemetry showing Firefox for iOS or Focus for iOS handing off FIDO: URIs to the operating system shortly after visiting an untrusted page.
  • Unexpected Bluetooth Low Energy pairing events on iOS devices coinciding with browser navigation.
  • Authentication logs from identity providers showing successful WebAuthn hybrid transport logins from unrecognized client devices.

Detection Strategies

  • Inspect identity provider sign-in logs for WebAuthn assertions using the hybrid (caBLE) transport that originate from new or unfamiliar client platforms.
  • Correlate user-reported phishing pages with browser version data to flag devices still running Firefox for iOS or Focus for iOS below version 142.
  • Audit mobile device management (MDM) inventory for vulnerable Firefox and Focus build numbers across the iOS fleet.

Monitoring Recommendations

  • Alert on geographically improbable logins where the authenticator (mobile device) and the relying party client are in different locations within the same minute.
  • Track repeated WebAuthn ceremonies that abort during the hybrid transport handshake.
  • Forward iOS browser telemetry and identity provider events to a central data lake for correlation across endpoint and identity signals.

How to Mitigate CVE-2025-55031

Immediate Actions Required

  • Update Firefox for iOS and Focus for iOS to version 142 or later through the Apple App Store.
  • Push an MDM policy that enforces minimum browser versions on managed iPhones and iPads.
  • Educate users to dismiss unexpected passkey prompts that appear after visiting unfamiliar links.

Patch Information

Mozilla fixed CVE-2025-55031 in Firefox for iOS 142 and Focus for iOS 142. Patch details are documented in Mozilla Security Advisory MFSA-2025-68, Mozilla Security Advisory MFSA-2025-69, Mozilla Bug #1979499, and Mozilla Bug #1979804.

Workarounds

  • Use an alternate iOS browser until the Firefox update can be installed.
  • Disable Bluetooth on iOS devices when browsing untrusted sites to block hybrid transport pairing.
  • Require phishing-resistant, device-bound passkeys without hybrid transport for high-value accounts where the identity provider permits this restriction.

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

Experience the Most Advanced Cybersecurity Platform

See how the world’s most intelligent, autonomous cybersecurity platform can protect your organization today and into the future.

Try SentinelOne