VulnerabilityModified
CVE-2025-3859
This vulnerability was fixed in Focus 138.
MEDIUM 6.1EPSS 0.20%
Does this matter?
Lower severity and a low EPSS score (0.20%). Track it; it rarely justifies an emergency change on its own.
Description
Websites directing users to long URLs that caused eliding to occur in the location view could leverage the truncating behavior to potentially trick users into thinking they were on a different webpage. This vulnerability was fixed in Focus 138.
- CVSS 3.1
- 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.20% probability · 9th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-601, CWE-451
- Affected
- mozilla/firefox focus
- Source
- security@mozilla.org
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1951533Issue Tracking
- https://www.mozilla.org/security/advisories/mfsa2025-33/Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.