CVE-2025-9186

MediumCVSS 6.5/10Last modified Sep 30, 2026

Description

Spoofing issue in the Address Bar component of Firefox Focus for Android. This vulnerability was fixed in Firefox 142.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-451

Affected software

No affected versions have been published.

Timeline

Published
Aug 19, 2025
Last modified
Sep 30, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-91879.8Memory safety bugs present in Firefox 141 and Thunderbird 141. Some of these bugs showed evidence of memory corruption and we presume that wCVE-2025-91887.8There is a deserialization of untrusted data vulnerability in Digilent DASYLab. This vulnerability may result in arbitrary code execution. CVE-2025-91897.8There is an out of bounds write vulnerability due to improper bounds checking resulting in a large destination address when parsing a DSB fiCVE-2025-91904.8The configuration of Cursor on macOS, specifically the "RunAsNode" fuse enabled, allows a local attacker with unprivileged access to executeCVE-2025-91916.3The Houzez theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.1.6 via deserialization of untrCVE-2025-91933.5A flaw has been found in TOTVS Portal Meu RH up to 12.1.17. Impacted is an unknown function of the component Password Reset Handler. ExecutiCVE-2025-91944.3The Constructor theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the clean() funcCVE-2025-91954.4Improper input validation in firmware of some Solidigm DC Products may allow an attacker with local access to cause a Denial of ServiceCVE-2025-91965.3The Trinity Audio – Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Sensitive InformationCVE-2025-91986.5The Wp cycle text announcement plugin for WordPress is vulnerable to SQL Injection via the 'cycle-text' shortcode in all versions up to, andCVE-2025-91996.5The Woo superb slideshow transition gallery with random effect plugin for WordPress is vulnerable to SQL Injection via the 'woo-superb-slideCVE-2025-92007.5The Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App plugin for WordPress is vulnerable to SQL Injection via the
CVE-2025-9186: Medium severity, CVSS 6.5 | Vulnix