Home

CVE-2025-8042

Description

Firefox for Android allowed a sandboxed iframe without the allow-downloads attribute to start downloads. This vulnerability was fixed in Firefox 141.

Risk Information

Base Score
9.8
MODERATE
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
Exploitation Probability
0.067

Associated Vulnerability

VulnerabilityOS Platform
Multiple vulnerabilities are fixed in Mozilla Firefox (141.0)Windows
Multiple vulnerabilities are fixed in Mozilla Firefox (x64) (141.0)Windows
Multiple Vulnerabilities are affected in Mozilla Firefox (x64) 140.99Windows
Multiple Vulnerabilities are affected in Mozilla_Firefox 140.99Windows
Multiple vulnerabilities are fixed in Mozilla Firefox For Mac (141.0.2)Mac
Multiple vulnerabilities are fixed in Mozilla Firefox For Mac (141.0.3)Mac

Patch Details

Click to see the patches provided by ManageEngine for this CVE
Patch IDPatch Description
PATCH-349938Mozilla Firefox (141.0)
PATCH-349939Mozilla Firefox (x64) (141.0)
PATCH-351030Mozilla Firefox (x64) (142.0.1)
PATCH-351029Mozilla Firefox (142.0.1)
PATCH-611870Mozilla Firefox For Mac (142.0.1)
PATCH-611870Mozilla Firefox For Mac (142.0.1)

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234