CVE-2025-1941 Lock screen setting bypass in Firefox Focus for Android

Critical 9.1 Published 4 Mar 2025 Updated 4 Jun 2026

Attackers can bypass the optional lock screen authentication in Firefox Focus for Android, gaining unauthorized access to the browser session.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2025-1941?

CVE-2025-1941 is a critical vulnerability in Mozilla Firefox, published on 4 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been be bypassed (distinct from CVE-2025-0245). This vulnerability was fixed in Firefox 136.

Weakness: CWE-284

Which versions are affected by CVE-2025-1941?

It affects 1 product.

Products include Mozilla Firefox.

How do I fix CVE-2025-1941?

Upgrade to a fixed version.

Is CVE-2025-1941 being exploited?

There is no known exploitation of CVE-2025-1941 in the wild and no public exploit code.

All Mozilla Firefox vulnerabilities

Sources

Also known as GHSA-m793-xp46-r76w.