CVE-2025-14744
Medium · 6.5CVSS
6.5
EPSS
0.2%
Published
Dec 18, 2025
CISA due date
—
The record
Unicode RTLO characters could allow malicious websites to spoof filenames in the downloads UI for Firefox for iOS, potentially tricking users into saving files of an unexpected file type. This vulnerability was fixed in Firefox for iOS 144.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-87649 UI misrepresentation in Downloads in Google Chrome prior to 153.0.8010.36 allowed a… CWE-451
- CVE-2026-87653 UI misrepresentation in FullScreen in Google Chrome on on Windows prior to 153.0.8010.36… CWE-451
- CVE-2026-87635 UI misrepresentation in Payments in Google Chrome prior to 153.0.8010.36 allowed a remote… CWE-451
- CVE-2026-87624 UI misrepresentation in Passwords in Google Chrome on on Android prior to 153.0.8010.36… CWE-451
- CVE-2026-87597 UI misrepresentation in CustomTabs in Google Chrome on on Android prior to 153.0.8010.36… CWE-451
- CVE-2026-87583 UI misrepresentation in Passwords in Google Chrome on on Android prior to 153.0.8010.36… CWE-451
- CVE-2026-87567 UI misrepresentation in UrlFormatting in Google Chrome prior to 153.0.8010.36 allowed a… CWE-451
- CVE-2026-87559 UI misrepresentation in UI in Google Chrome prior to 153.0.8010.36 allowed a remote… CWE-451