CVE-2025-1941

What it actually does

Bypasses an opt-in authentication requirement in Firefox Focus, allowing unauthenticated access to the browser under specific conditions, resulting in full compromise of confidentiality and integrity without affecting availability.

Why it matters to the business

Organizations relying on Firefox Focus for secure browsing face elevated risk of data exposure or unauthorized actions if the authentication setting is in use; the low EPSS and absence from KEV reduce immediate urgency but the high CVSS warrants prompt attention given the browser's widespread use.

How an attack unfolds

An attacker identifies a target using the opt-in Focus authentication setting and crafts conditions to trigger the bypass, gaining direct access to browser functionality and data without providing credentials.

How to fix it

Upgrade Mozilla Firefox to version 136 or later to resolve the authentication bypass in Focus.

How to confirm the fix worked

Confirm deployment of Firefox 136+ across all instances and verify that the authentication setting enforces login as expected after upgrade.

Typical attack path

1. Identify target using Firefox Focus with authentication opt-in enabled
2. Trigger specific circumstances that activate the bypass
3. Access browser session and data without authentication

How to detect it

Review browser update logs and configuration files for versions prior to 136; check for unexpected access patterns to Focus data without authentication events.

What your security team should do

• Prioritize upgrade to Firefox 136 or newer on all systems using Focus
• Review and test the authentication setting post-upgrade
• Monitor for any related Firefox updates