← Database

CVE-2025-11716

MEDIUM CVSS: 6.5 Published: 2025-10-14 Modified: 2026-06-17

Description

Links in a sandboxed iframe could open an external app on Android without the required "allow-" permission. This vulnerability was fixed in Firefox 144 and Thunderbird 144.

Affected Platforms

Mozilla FirefoxGoogle AndroidMozilla Thunderbird

Weakness Type

CWE-284

References