CVE-2025-0246

MediumCVSS 6.5/10Last modified Oct 5, 2026

Description

When using an invalid protocol scheme, an attacker could spoof the address bar. *Note: This issue only affected Android operating systems. Other operating systems are unaffected.* *Note: This issue is a different issue from CVE-2025-0244. This vulnerability was fixed in Firefox 134.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published
Jan 7, 2025
Last modified
Oct 5, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-02479.8Memory safety bugs present in Firefox 133 and Thunderbird 133. Some of these bugs showed evidence of memory corruption and we presume that wCVE-2025-02488.1HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of user-supplied input. A reCVE-2025-02495.9HCL IEM is affected by an improper invalidation of access or JWT token vulnerability.  A token was not invalidated which may allow attackersCVE-2025-02504.9HCL IEM is affected by an authorization token sent in cookie vulnerability.  A token used for authentication and authorization is being handCVE-2025-02515.7HCL IEM is affected by a concurrent login vulnerability.  The application allows multiple concurrent sessions using the same user credentialCVE-2025-02524.8HCL IEM is affected by a password in cleartext vulnerability.  Sensitive information is transmitted without adequate protection, potentiallyCVE-2025-02532.4HCL IEM is affected by a cookie attribute not set vulnerability due to inconsistency of certain security-related configurations which could CVE-2025-02545.9HCL Digital Experience components Ring API and dxclient may be vulnerable to man-in-the-middle (MitM) attacks prior to 9.5 CF226. An attackCVE-2025-02557.2HCL DevOps Deploy / HCL Launch could allow a remote privileged authenticated attacker to execute arbitrary commands on the system by sendingCVE-2025-02566.5HCL DevOps Deploy / HCL Launch could allow an authenticated user to obtain sensitive information about other users on the system due to missCVE-2025-02577.5HCL DevOps Deploy / HCL Launch could allow unauthorized access to other services or potential exposure of sensitive data due to missing authCVE-2025-02727.6HCL DevOps Deploy / HCL Launch is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web