CVE-2025-55031

The vulnerability results from improper validation of redirects (CWE-601 — open redirect) in the handling of FIDO: schemes in the Firefox for iOS application. A malicious website could inject a FIDO: link and instruct the operating system to launch hybrid passkey transport based on Bluetooth. An attacker within Bluetooth range of the victim could impersonate a legitimate target device, thereby causing the user to authorize the attacker's session instead of their own.

The attacker can take full control of the victim's account on the target service, because the user unknowingly authenticates the attacker's login session using their own passkey. This results in a breach of confidentiality and integrity of the protected account.

Firefox for iOS should be immediately updated to version 142 or later, and Firefox Focus for iOS should be updated to version 142 or later. Updates are available through the Apple App Store. Until the update is applied, avoid visiting untrusted websites in environments with Bluetooth enabled.

Firefox for iOS in versions prior to 142 and Firefox Focus for iOS in versions prior to 142.