CVE-2025-55031
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-08-19

Last updated on: 2026-04-13

Assigner: Mozilla Corporation

Description
Malicious pages could use Firefox for iOS to pass FIDO: links to the OS and trigger the hybrid passkey transport. An attacker within Bluetooth range could have used this to trick the user into using their passkey to log the attacker's computer into the target account. This vulnerability was fixed in Firefox for iOS 142 and Focus for iOS 142.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-08-19
Last Modified
2026-04-13
Generated
2026-05-07
AI Q&A
2025-08-19
EPSS Evaluated
2026-05-05
NVD
CVE-2025-55031
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
mozilla firefox From 60.9.0 (exc)
mozilla firefox_focus From 60.9.0 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-601 The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability involves malicious web pages using Firefox for iOS to interact with the operating system and trigger the hybrid passkey transport via FIDO. An attacker within Bluetooth range could exploit this to trick a user into using their passkey, allowing the attacker to log into the user's account on the attacker's computer.


How can this vulnerability impact me? :

If exploited, this vulnerability could allow an attacker nearby (within Bluetooth range) to gain unauthorized access to your accounts by tricking you into using your passkey, potentially compromising your personal or sensitive information.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart