CVE-2025-23108

Vulnerability

CVE-2025-23108 is a URL spoofing vulnerability in Firefox for iOS. When a user long-presses a javascript: link to open it in a new tab, a malicious script could manipulate the address bar of the newly opened tab, displaying a fake URL while the actual content is controlled by the attacker. The root cause lies in how the browser handles the context of javascript: URIs during the new-tab creation flow triggered by a long-press gesture. [1]

Exploitation

Exploitation requires user interaction: the victim must long-press a crafted javascript: link and choose to open it in a new tab. No additional privileges are needed; the attack is performed entirely client-side via a webpage the victim visits. The malicious script then spoofs the address bar of the resulting blank tab to show an arbitrary, legitimate-looking URL. [1]

Impact

A successful attack could trick the victim into believing they are on a trusted site (e.g., a login page or familiar web service). This could be used to facilitate phishing or to deliver further malicious content under the guise of a legitimate domain. The impact is rated moderate by Mozilla due to the required user interaction and the limited scope of address bar spoofing. [1]

Mitigation

Firefox for iOS 134, released January 10, 2025, fixes this vulnerability. Users should update to the latest version from the App Store. No workarounds are documented, and Mozilla's advisory lists no evidence of exploitation in the wild. [1]