CVE-2025-1940 - Vulnerability Details - OpenCVE

A select option could partially obscure the confirmation prompt shown before launching external apps. This could be used to trick a user in to launching an external app unexpectedly. *This issue only affects Android versions of Firefox.* This vulnerability affects Firefox < 136.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://bugzilla.mozilla.org/show_bug.cgi?id=1908488
https://nvd.nist.gov/vuln/detail/CVE-2025-1940
https://www.cve.org/CVERecord?id=CVE-2025-1940
https://www.mozilla.org/security/advisories/mfsa2025-14/

History

Wed, 05 Mar 2025 03:00:00 +0000

Type	Values Removed	Values Added
Title		firefox: Android Intent confirmation prompt tapjacking using Select options
Weaknesses		CWE-451
References		https://nvd.nist.gov/vuln/detail/CVE-2025-1940 https://www.cve.org/CVERecord?id=CVE-2025-1940
Metrics	threat_severity `None`	threat_severity `Moderate`

Tue, 04 Mar 2025 16:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-1021
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 04 Mar 2025 13:45:00 +0000

Type	Values Removed	Values Added
Description		A select option could partially obscure the confirmation prompt shown before launching external apps. This could be used to trick a user in to launching an external app unexpectedly. This issue only affects Android versions of Firefox. This vulnerability affects Firefox < 136.
References		https://bugzilla.mozilla.org/show_bug.cgi?id=1908488 https://www.mozilla.org/security/advisories/mfsa2025-14/

MITRE

Status: PUBLISHED

Assigner: mozilla

Published: 2025-03-04T13:31:24.265Z

Updated: 2025-03-04T15:57:34.877Z

Reserved: 2025-03-04T12:29:45.975Z

Link: CVE-2025-1940

Vulnrichment

Updated: 2025-03-04T15:57:29.783Z

NVD

Status : Received

Published: 2025-03-04T14:15:38.950

Modified: 2025-03-04T16:15:38.310

Link: CVE-2025-1940

Redhat

Severity : Moderate

Publid Date: 2025-03-04T13:31:24Z

Links: CVE-2025-1940 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-1940", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "state": "PUBLISHED", "assignerShortName": "mozilla", "dateReserved": "2025-03-04T12:29:45.975Z", "datePublished": "2025-03-04T13:31:24.265Z", "dateUpdated": "2025-03-04T15:57:34.877Z"}, "containers": {"cna": {"affected": [{"product": "Firefox", "vendor": "Mozilla", "versions": [{"lessThan": "136", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "A select option could partially obscure the confirmation prompt shown before launching external apps. This could be used to trick a user in to launching an external app unexpectedly. \n*This issue only affects Android versions of Firefox.* This vulnerability affects Firefox < 136.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "A select option could partially obscure the confirmation prompt shown before launching external apps. This could be used to trick a user in to launching an external app unexpectedly. <br>*This issue only affects Android versions of Firefox.* This vulnerability affects Firefox < 136."}]}], "problemTypes": [{"descriptions": [{"description": "Android Intent confirmation prompt tapjacking using Select options", "lang": "en", "type": "text"}]}], "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1908488"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-14/"}], "credits": [{"lang": "en", "value": "Shaheen Fazim"}], "providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2025-03-04T13:31:24.265Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-1021", "lang": "en", "description": "CWE-1021 Improper Restriction of Rendered UI Layers or Frames"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-03-04T15:55:08.191960Z", "id": "CVE-2025-1940", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-04T15:57:34.877Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-1940", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-04T15:55:08.191960Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1021", "description": "CWE-1021 Improper Restriction of Rendered UI Layers or Frames"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-04T15:57:29.783Z"}}], "cna": {"credits": [{"lang": "en", "value": "Shaheen Fazim"}], "affected": [{"vendor": "Mozilla", "product": "Firefox", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "136", "versionType": "custom"}]}], "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1908488"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-14/"}], "descriptions": [{"lang": "en", "value": "A select option could partially obscure the confirmation prompt shown before launching external apps. This could be used to trick a user in to launching an external app unexpectedly. \n*This issue only affects Android versions of Firefox.* This vulnerability affects Firefox < 136.", "supportingMedia": [{"type": "text/html", "value": "A select option could partially obscure the confirmation prompt shown before launching external apps. This could be used to trick a user in to launching an external app unexpectedly. <br>*This issue only affects Android versions of Firefox.* This vulnerability affects Firefox < 136.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "Android Intent confirmation prompt tapjacking using Select options"}]}], "providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2025-03-04T13:31:24.265Z"}}}, "cveMetadata": {"cveId": "CVE-2025-1940", "state": "PUBLISHED", "dateUpdated": "2025-03-04T15:57:34.877Z", "dateReserved": "2025-03-04T12:29:45.975Z", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "datePublished": "2025-03-04T13:31:24.265Z", "assignerShortName": "mozilla"}, "dataVersion": "5.1"}