CVE-2025-6428

When a URL was provided in a link querystring parameter, Firefox for Android would follow that URL instead of the correct URL, potentially leading to phishing attacks. *This bug only affects Firefox for Android. Other versions of Firefox are unaffected.*. This vulnerability was fixed in Firefox 140.

• CWE-601

• https://bugzilla.mozilla.org/show_bug.cgi?id=1970151Exploit, Issue Tracking, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2025-51/Vendor Advisory

Published

Jun 24, 2025

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-64272Exposure of Sensitive System Information to an Unauthorized …6.5
• CVE-2025-64273Missing Authorization vulnerability in GetResponse Email mar…6.5
• CVE-2025-64274Missing Authorization vulnerability in wpkoithemes WPKoi Tem…4.3
• CVE-2025-64275Improper Neutralization of Input During Web Page Generation …6.5
• CVE-2025-64276Missing Authorization vulnerability in Ays Pro Survey Maker …6.5
• CVE-2025-64277Missing Authorization vulnerability in QuantumCloud ChatBot …5.3
• CVE-2025-64280A SQL Injection Vulnerability in CentralSquare Community Dev…9.8
• CVE-2025-64281An Authentication Bypass issue in CentralSquare Community De…9.8
• CVE-2025-64282Authorization Bypass Through User-Controlled Key vulnerabili…4.3
• CVE-2025-64283Authorization Bypass Through User-Controlled Key vulnerabili…6.5
• CVE-2025-64284Improper Control of Filename for Include/Require Statement i…7.5
• CVE-2025-64285Missing Authorization vulnerability in Premmerce Premmerce W…5.4