PT-2025-41908 · Mozilla+1 · Firefox+2

Published 2025-10-14 · Updated 2026-04-15 · CVE-2025-11720

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 144 Firefox Focus versions prior to 144

Description The user interface for the Android custom tab feature in Firefox and Firefox Focus displayed only the "site" loaded, and not the complete hostname. This allowed user-supplied content hosted on a subdomain to mislead users into believing it originated from a different subdomain of the same site.

Recommendations Update Firefox to version 144 or later. Update Firefox Focus to version 144 or later.

Fix

UI Misrepresentation of Critical Information

Weakness Enumeration

CWE-451

Related Identifiers

ALT-PU-2025-13476

BDU:2025-14553

CVE-2025-11720

OPENSUSE-SU-2025:15645-1

Affected Products

Alt Linux

Firefox

Firefox Focus

References · 28

• https://mozilla.org/en-US/security/advisories/mfsa2025-81 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15645-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-11720 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-11720 · Security Note
• https://bdu.fstec.ru/vul/2025-14553 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-11720 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-11720 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-11720 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2025-81/#CVE-2025-11720 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2025-81 · Vendor Advisory
• https://suse.com/security/cve/CVE-2025-11719 · Note
• https://suse.com/security/cve/CVE-2025-11708 · Note
• https://suse.com/security/cve/CVE-2025-11713 · Note
• https://suse.com/security/cve/CVE-2025-11720 · Note
• https://twitter.com/giuseppe_1337/status/2044250765825327600 · Twitter Post