Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2025-55031 is a critical-severity Open Redirect (CWE-601) vulnerability in Mozilla Firefox. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Phishing (T1566); ranked at the 34th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-55031 is a high-severity vulnerability in Firefox for iOS that enables malicious web pages to pass FIDO: links to the iOS operating system, thereby triggering the hybrid passkey transport mechanism. The affected software includes Firefox for iOS and Focus for iOS versions prior to 142. Classified under CWE-601 (URL Redirection to Untrusted Site), it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical impact on confidentiality, integrity, and availability.
The attack scenario involves a remote attacker hosting a malicious page accessible via Firefox for iOS. An attacker within Bluetooth range can exploit this to trick the user into authenticating with their passkey, allowing the attacker's computer to log into the target account. No special privileges are required, and the exploit leverages network access with low complexity.
Mozilla has fixed this vulnerability in Firefox for iOS 142 and Focus for iOS 142. Security advisories MFSA 2025-68 and MFSA 2025-69 detail the patch, and practitioners should prioritize updating affected devices. Additional technical details are available in Bugzilla entries 1979499 and 1979804.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-25225
Vulnerability Data
Malicious pages could use Firefox for iOS to pass FIDO: links to the OS and trigger the hybrid passkey transport. An attacker within Bluetooth range could have used this to trick the user into using their passkey to log the…
more
attacker's computer into the target account. This vulnerability was fixed in Firefox for iOS 142 and Focus for iOS 142.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V3.7.2
Mitigating Controls (NIST 800-53 r5) AI
Input validation directly checks and rejects untrusted redirect targets before they are used in a response.
Information flow enforcement can restrict redirects to only approved/trusted destinations, stopping untrusted user-supplied URLs from being followed.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input validation and untrusted-redirect controls that prevent CWE-601.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Preventing access to attacker-controlled or malicious sites stops users from being redirected to untrusted locations via open-redirect or phishing links.