CVE-2025-27425

What it actually does

The flaw allows bypassing the user confirmation prompt when opening URLs from QR codes containing text with website links in Firefox for iOS due to improper input validation of QR content.

Why it matters to the business

Users on affected mobile devices may inadvertently visit malicious sites without warning, increasing exposure to phishing or unwanted content with low overall risk given stable low exploit probability and no known campaigns.

How an attack unfolds

An attacker embeds a website URL in text within a QR code; when scanned by an unpatched Firefox for iOS instance the URL is opened directly without the expected alert.

How to fix it

Update Firefox for iOS to version 136 or later where the QR code handling validation was corrected.

How to confirm the fix worked

Confirm Firefox for iOS version is at least 136; test by scanning QR codes containing URLs and verify that a confirmation alert is presented before opening.

Typical attack path

1. Craft QR code embedding URL in text payload
2. Distribute QR code via physical or digital means to targets
3. Victim scans code using Firefox for iOS
4. Browser opens URL without confirmation prompt

How to detect it

Review browser history and device logs for unexpected URL navigation events immediately following QR code scans on Firefox for iOS prior to version 136; no widespread exploitation indicators reported.

What your security team should do

• Prioritize updating all Firefox for iOS instances to version 136+
• Review mobile app update policies to enforce timely patching
• Educate users on verifying links from QR codes even after update