PT-2025-41904 · Mozilla+1 · Thunderbird+2

Axel Chong · CVE-2025-11716 · Published 2025-10-14 · Updated 2025-11-10

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 144 Thunderbird versions prior to 144

Description A flaw exists where links within a sandboxed iframe can trigger the opening of an external application on Android devices, bypassing the necessary "allow-" permissions. This could potentially allow for unauthorized access or execution of applications.

Recommendations Update Firefox to version 144 or later. Update Thunderbird to version 144 or later.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

ALT-PU-2025-13476

ALT-PU-2025-13478

CVE-2025-11716

OPENSUSE-SU-2025:15645-1

Affected Products

Alt Linux

Firefox

Thunderbird

References · 25

• https://mozilla.org/en-US/security/advisories/mfsa2025-81/#CVE-2025-11716 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2025-81 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-11716 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2025-84 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-11716 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15645-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-11716 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-11716 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-11716 · Security Note
• https://suse.com/security/cve/CVE-2025-11721 · Note
• https://suse.com/security/cve/CVE-2025-11717 · Note
• https://suse.com/security/cve/CVE-2025-11709 · Note
• https://suse.com/security/cve/CVE-2025-11718 · Note
• https://suse.com/security/cve/CVE-2025-11720 · Note
• https://suse.com/security/cve/CVE-2025-11708 · Note