CVE-2025-54143

CriticalCVSS 9.8/10Last modified Oct 5, 2026

Description

Sandboxed iframes on webpages could potentially allow downloads to the device, bypassing the expected sandbox restrictions declared on the parent page. This vulnerability was fixed in Firefox for iOS 141.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-693

Affected software

VendorProductVersions
MozillaFirefox for iOS—

References

Timeline

Published
Aug 19, 2025
Last modified
Oct 5, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-541445.4The URL scheme used by Firefox to facilitate searching of text queries could incorrectly allow attackers to open arbitrary website URLs or iCVE-2025-541459.1The QR scanner could allow arbitrary websites to be opened if a user was tricked into scanning a malicious link that leveraged Firefox's opeCVE-2025-541466.5A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can thenCVE-2025-541476.5A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can thenCVE-2025-541486.5A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can thenCVE-2025-541495.5An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a local attacker gains a user account, theyCVE-2025-541505.5An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a local attacker gains a user account, theyCVE-2025-541515.5An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a local attacker gains a user account, theyCVE-2025-541526.5A use of out-of-range pointer offset vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, theCVE-2025-541538.8An SQL injection vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit tCVE-2025-541546.8An improper authentication vulnerability has been reported to affect QNAP Authenticator. If an attacker gains physical access, they can thenCVE-2025-541554.9An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains
CVE-2025-54143: Critical severity, CVSS 9.8 | Vulnix