BaseFortify

Publication date: 2025-10-14

Last updated on: 2026-04-13

Assigner: Mozilla Corporation

Description

Links in a sandboxed iframe could open an external app on Android without the required "allow-" permission. This vulnerability was fixed in Firefox 144 and Thunderbird 144.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-14

Last Modified

2026-04-13

Generated

2026-07-06

AI Q&A

2025-10-14

EPSS Evaluated

2026-07-05

NVD

CVE-2025-11716

Affected Vendors & Products

Vendor	Product	Version / Range
mozilla	thunderbird	to 140.0 (inc)
google	android	*
mozilla	firefox	From 60.9.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability occurs when links inside a sandboxed iframe on Android devices can open an external application without having the necessary "allow-" permission. It affects Firefox and Thunderbird versions earlier than 144.

Impact Analysis

The vulnerability could allow a malicious link within a sandboxed iframe to launch external applications on an Android device without user consent or proper permission. This could lead to unauthorized app launches, potentially exposing the user to further attacks or privacy risks.

Mitigation Strategies

To mitigate this vulnerability, update Firefox and Thunderbird to version 144 or later, as the issue affects versions prior to 144 and is fixed in 144.

Hi! I’m here to help you understand CVE-2025-11716. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70