PT-2025-26725 · Mozilla+2 · Firefox For Android+2

Raul Bucata · Published 2025-06-24 · Updated 2025-11-19 · CVE-2025-6428

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Firefox for Android versions prior to 140

Description: The issue allows an attacker to potentially lead to phishing attacks by following a provided URL in a link querystring parameter instead of the correct URL. This affects Firefox for Android, with other versions of Firefox being unaffected.

Recommendations: For Firefox for Android versions prior to 140, update to version 140 or later to resolve the issue. As a temporary workaround, consider avoiding the use of link querystring parameters until the update is applied.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

ALT-PU-2025-11100

ALT-PU-2025-11497

ALT-PU-2025-14599

ALT-PU-2025-8725

BDU:2025-07651

CVE-2025-6428

OPENSUSE-SU-2025:15325-1

OPENSUSE-SU-2025:15371-1

SUSE-SU-2025:02339-1

SUSE-SU-2025:02529-1

SUSE-SU-2025_02339-1

SUSE-SU-2025_02529-1

Affected Products

Alt Linux

Firefox For Android

Suse

References · 47

• https://nvd.nist.gov/vuln/detail/CVE-2025-6428 · Security Note
• https://mozilla.org/security/advisories/mfsa2025-51 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:02339-1 · Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1970151 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-07651 · Security Note
• https://ubuntu.com/security/CVE-2025-6428 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:02529-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-6428 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-6428 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-6428 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15325-1 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2025-51/#CVE-2025-6428 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15371-1 · Vendor Advisory
• https://suse.com/security/cve/CVE-2025-8037 · Note
• https://suse.com/security/cve/CVE-2025-8039 · Note