CVE-2025-11716 Sandboxed iframes allowed links to open in external apps (Android only)
Attackers can bypass sandbox restrictions to launch external Android apps via links in iframes, affecting Firefox and Thunderbird users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-11716?
CVE-2025-11716 is a medium-severity vulnerability in Mozilla Firefox, published on 14 Oct 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Links in a sandboxed iframe could open an external app on Android without the required "allow-" permission. This vulnerability was fixed in Firefox 144 and Thunderbird 144.
Weakness: CWE-284
Which versions are affected by CVE-2025-11716?
It affects 2 products.
Products include Mozilla Firefox, Mozilla Thunderbird.
How do I fix CVE-2025-11716?
Upgrade to a fixed version.
Is CVE-2025-11716 being exploited?
There is no known exploitation of CVE-2025-11716 in the wild and no public exploit code.
Other vulnerabilities in Mozilla Firefox
Sources
Also known as GHSA-p8g8-q63w-8jgm, UBUNTU-CVE-2025-11716.