CVE-2025-1935

MediumCVSS 4.3/10Last modified Oct 5, 2026

Description

A web page could trick a user into setting that site as the default handler for a custom URL protocol. This vulnerability was fixed in Firefox 136, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Mar 4, 2025
Last modified: Oct 5, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-19367.3jar: URLs retrieve local file content packaged in a ZIP archive. The null and everything after it was ignored when retrieving the content fr CVE-2025-19377.5Memory safety bugs present in Firefox 135, Thunderbird 135, Firefox ESR 115.20, Firefox ESR 128.7, and Thunderbird 128.7. Some of these bugs CVE-2025-19386.5Memory safety bugs present in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7. Some of these bugs showed evidence of CVE-2025-19393.9Android apps can load web pages using the Custom Tabs feature. This feature supports a transition animation that could have been used to tri CVE-2025-19407.1A select option could partially obscure the confirmation prompt shown before launching external apps. This could be used to trick a user in CVE-2025-19419.1Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been be bypassed (distinct CVE-2025-19429.8When String.toUpperCase() caused a string to get longer it was possible for uninitialized memory to be incorporated into the result string. CVE-2025-19438.2Memory safety bugs present in Firefox 135 and Thunderbird 135. Some of these bugs showed evidence of memory corruption and we presume that w CVE-2025-19446.5picklescan before 0.0.23 is vulnerable to a ZIP archive manipulation attack that causes it to crash when attempting to extract and scan PyTo CVE-2025-19459.8picklescan before 0.0.23 fails to detect malicious pickle files inside PyTorch model archives when certain ZIP file flag bits are modified. CVE-2025-19469.8A vulnerability was found in hzmanyun Education and Training System 2.1. It has been rated as critical. Affected by this issue is the functi CVE-2025-19479.8A vulnerability classified as critical has been found in hzmanyun Education and Training System 2.1.3. This affects the function scorm of th