CVE-2025-14744

Unknown Unknown - Not Provided

Unicode RTLO Spoofing in Firefox for iOS Downloads UI

Publication date: 2025-12-18

Last updated on: 2026-04-13

Assigner: Mozilla Corporation

Description

Unicode RTLO characters could allow malicious websites to spoof filenames in the downloads UI for Firefox for iOS, potentially tricking users into saving files of an unexpected file type. This vulnerability was fixed in Firefox for iOS 144.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-18

Last Modified

2026-04-13

Generated

2026-07-06

AI Q&A

2025-12-18

EPSS Evaluated

2026-07-05

NVD

CVE-2025-14744

EUVD

EUVD-2025-204291

Affected Vendors & Products

Vendor	Product	Version / Range
mozilla	firefox_for_ios	144.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-451	The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.

Attack-Flow Graph

Impact Analysis

The impact of this vulnerability is that users might be deceived into downloading and saving files that appear to be safe or of a certain type, but are actually different or potentially harmful. This could lead to inadvertent execution of malicious files or exposure to security risks. [1]

Executive Summary

This vulnerability involves the use of Unicode Right-to-Left Override (RTLO) characters by malicious websites to spoof filenames in the downloads user interface of Firefox for iOS. This means attackers can manipulate how filenames appear, potentially tricking users into saving files with misleading or unexpected file types. [1]

Detection Guidance

This vulnerability involves Unicode RTLO characters spoofing filenames in Firefox for iOS downloads UI. Detection would involve monitoring downloaded filenames for suspicious use of RTLO characters (Unicode U+202E). Since this is specific to Firefox for iOS and its downloads UI, there are no specific network commands provided to detect it. Users can manually inspect downloaded filenames for unexpected reversed text or unusual file extensions caused by RTLO characters. [1]

Mitigation Strategies

To mitigate this vulnerability, update Firefox for iOS to version 144.0 or later, which includes the fix preventing RTLO character misuse in filenames. Avoid downloading files from untrusted websites and be cautious of filenames that appear suspicious or have unexpected file extensions. [1]

Hi! I’m here to help you understand CVE-2025-14744. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70