CVE-2025-55032: Mozilla Firefox Focus XSS Vulnerability

CVE-2025-55032 Overview

CVE-2025-55032 affects Mozilla Firefox Focus for iOS, a privacy-focused mobile browser. The browser fails to honor Content-Disposition: attachment headers and renders the referenced content inline instead of triggering a download. This behavior allows attacker-controlled files served with an attachment disposition to execute in the browser context, enabling cross-site scripting (XSS) attacks. Mozilla addressed the flaw in Firefox Focus for iOS version 142. The issue is tracked under [CWE-601] and documented in Mozilla Security Advisory MFSA-2025-69.

Critical Impact
An attacker can deliver script content with a Content-Disposition: attachment header and have Focus for iOS render it inline, executing script in a security-sensitive context and enabling XSS against users who open the link.

Affected Products

Mozilla Firefox Focus for iOS (versions prior to 142)
iOS platform builds only (cpe:2.3:a:mozilla:firefox_focus:*:*:*:*:*:iphone_os:*:*)
Users of Firefox Focus who follow untrusted links to attacker-hosted content

Discovery Timeline

2025-08-19 - CVE-2025-55032 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-55032

Vulnerability Analysis

The Content-Disposition HTTP response header instructs the browser how to handle response content. A value of attachment should cause the browser to save the response as a file rather than render it. Firefox Focus for iOS ignored this directive and displayed the content inline. When the response body contains HTML or JavaScript, the browser parses and executes it in the origin context of the URL.

Exploitation requires user interaction, typically clicking a crafted link. The scope change in the vulnerability metrics reflects that script execution can affect resources beyond the initially requested component, including sibling origins and any data accessible to the browser session. Confidentiality and integrity impact are limited, and availability is unaffected.

Root Cause

The root cause is improper handling of HTTP response headers within the iOS-specific content rendering path of Focus. The browser did not branch on the Content-Disposition value before deciding whether to render or download the payload. This behavior deviates from the standard defined in RFC 6266 and from the handling implemented in Firefox on other platforms.

Attack Vector

An attacker hosts a malicious HTML or script file on a controlled server and configures the response to include Content-Disposition: attachment. The attacker sends the URL to a target through phishing, messaging, or a compromised site. When the target opens the link in Focus for iOS, the browser renders the file inline and executes any embedded script. The script runs with access to the origin serving the file, enabling cookie theft, session token exfiltration, or drive-by redirection.

See Mozilla Bug Report #1976296 for the underlying technical discussion.

Detection Methods for CVE-2025-55032

Indicators of Compromise

Outbound HTTP requests from iOS devices to unfamiliar domains serving HTML or JavaScript with Content-Disposition: attachment headers.
Focus for iOS installations reporting versions earlier than 142 in mobile device management (MDM) inventory.
Web proxy logs showing responses combining text/html or application/javascript MIME types with an attachment disposition.

Detection Strategies

Inspect web gateway or TLS-terminating proxy logs for responses that pair Content-Disposition: attachment with script-capable content types delivered to iOS user agents.
Query MDM or unified endpoint management inventories for Firefox Focus app versions below 142 and flag them for remediation.
Correlate user-reported phishing links with browser telemetry to identify potential targets of an XSS delivery chain.

Monitoring Recommendations

Monitor mobile browser version drift and enforce automatic app updates through iOS device policy.
Alert on anomalous authentication events originating from mobile sessions immediately after users open external links.
Track newly registered domains referenced in SMS or email messages sent to enterprise iOS users.

How to Mitigate CVE-2025-55032

Immediate Actions Required

Update Firefox Focus for iOS to version 142 or later through the Apple App Store.
Push the update to managed iOS fleets using MDM configuration policies.
Communicate the vulnerability to users who install Focus outside of managed channels.

Patch Information

Mozilla resolved the vulnerability in Firefox Focus for iOS 142. Refer to Mozilla Security Advisory MFSA-2025-69 for release details and to Mozilla Bug Report #1976296 for the underlying fix.

Workarounds

Avoid opening untrusted links in Focus for iOS versions earlier than 142 until the update is applied.
Use an alternative browser on iOS that correctly honors Content-Disposition: attachment for high-risk browsing tasks.
Configure enterprise web gateways to strip or rewrite Content-Disposition headers on responses that also carry script-capable MIME types.

bash

# Configuration example: enforce Firefox Focus update via iOS MDM
# Example Jamf Pro policy snippet to require minimum app version
defaults write com.jamfsoftware.jamf RequiredAppVersion "org.mozilla.ios.Focus=142"