CVE-2025-23108

What it actually does

A long-press gesture to open a JavaScript link in a new tab fails to properly isolate or sanitize the target URL, allowing the opened tab's address bar to display an attacker-controlled value while the original script context remains active.

Why it matters to the business

Users may be tricked into believing they are visiting a legitimate site when they are not, increasing the chance of successful social-engineering or phishing attacks against the organization's workforce or customers who rely on the browser.

How an attack unfolds

An attacker hosts a page containing specially crafted JavaScript links. When a victim long-presses such a link in Firefox for iOS, the browser opens a new tab whose displayed URL is spoofed by the malicious script, enabling further phishing or credential-harvesting activity within that tab.

How to fix it

Upgrade all instances of Firefox for iOS to version 134 or later. Enforce automatic updates through MDM or app-store policies where possible and verify the installed version on managed devices.

How to confirm the fix worked

Confirm the Firefox for iOS application reports version 134 or higher in Settings > About Firefox. Reproduce the long-press action on a test JavaScript link and verify the new tab displays the correct, uns spoofed destination URL.

Typical attack path

1. Attacker prepares a web page with long-pressable JavaScript links that manipulate the new-tab URL
2. Victim visits the attacker's page using Firefox for iOS
3. Victim performs a long-press gesture on the crafted link
4. Browser opens a new tab showing the attacker-supplied URL while executing the original script
5. Victim interacts with the spoofed tab, potentially disclosing credentials or approving malicious actions

How to detect it

Review browser history and tab logs for entries opened via long-press gestures that originate from untrusted domains; correlate with network telemetry showing navigation to unexpected hosts immediately after a long-press event. No persistent artifacts are created on disk.

What your security team should do

• Immediately schedule deployment of Firefox for iOS 134 across all managed devices
• Add browser version checks to existing mobile-device compliance scans
• Educate users to update the browser promptly and to treat unexpected URL changes with caution
• Monitor vendor release notes for any follow-on fixes in subsequent point releases