CVE-2025-27424

What it actually does

Open redirect flaw permits redirection to non-HTTP scheme URLs, enabling address bar spoofing that displays a malicious page under a trusted origin.

Why it matters to the business

Users may be deceived into engaging with fake sites, increasing phishing success and potential malware exposure with limited direct infrastructure impact.

How an attack unfolds

Attacker creates a specially crafted redirect link targeting the browser's handling of non-HTTP schemes; victim is lured to click the link, resulting in the address bar showing a spoofed trusted site while loading attacker-controlled content.

How to fix it

Update Firefox for iOS to version 136 or later to resolve the redirect handling issue.

How to confirm the fix worked

Verify installed version is 136 or higher; test redirects involving non-HTTP schemes to confirm address bar behavior is corrected.

Typical attack path

1. Identify vulnerable Firefox for iOS instance
2. Craft redirect URL using non-HTTP scheme to spoof address bar
3. Distribute link via phishing email, message, or web page
4. Victim clicks link and interacts with spoofed malicious content

How to detect it

Inspect browser history and redirect logs for entries involving non-HTTP schemes; correlate with phishing reports since no server-side artifacts exist.

What your security team should do

• Apply the 136 update across all Firefox for iOS deployments immediately
• Block or filter known phishing links that leverage redirects
• Conduct user awareness training on verifying browser address bars