CVE-2025-8364
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-08-19

Last updated on: 2026-04-13

Assigner: Mozilla Corporation

Description
A crafted URL using a blob: URI could have hidden the true origin of the page, resulting in a potential spoofing attack. *Note: This issue only affected Android operating systems. Other operating systems are unaffected.*. This vulnerability was fixed in Firefox 141.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-08-19
Last Modified
2026-04-13
Generated
2026-05-07
AI Q&A
2025-08-19
EPSS Evaluated
2026-05-05
NVD
CVE-2025-8364
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
mozilla firefox From 60.9.0 (exc)
google android *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-451 The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability involves a crafted URL using a blob: URI that could hide the true origin of the page, potentially allowing an attacker to perform a spoofing attack. It specifically affects Firefox versions below 141 on Android operating systems.


How can this vulnerability impact me? :

The vulnerability could allow an attacker to spoof a webpage by hiding its true origin, potentially misleading users into trusting malicious content or phishing attempts on affected Firefox versions on Android.


What immediate steps should I take to mitigate this vulnerability?

Update Firefox on any affected Android devices to version 141 or later to eliminate the vulnerability.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart