CVE-2025-11717

When switching between Android apps using the card carousel Firefox shows a black screen as its card image when a password-related screen was the last one being used. Prior to Firefox 144 the password edit screen was visible. This vulnerability was fixed in Firefox 144.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://bugzilla.mozilla.org/show_bug.cgi?id=1872601	Issue Tracking Permissions Required
https://www.mozilla.org/security/advisories/mfsa2025-81/	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*

cpe:2.3:o:google:android:-:*:*:*:*:*:*:*

History

05 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary	(es) Al cambiar entre aplicaciones de Android usando el carrusel de tarjetas, Firefox muestra una pantalla negra como imagen de su tarjeta cuando una pantalla relacionada con contraseñas fue la última en ser utilizada. Antes de Firefox 144, la pantalla de edición de contraseñas era visible. Esta vulnerabilidad afecta a Firefox < 144.	(es) Al cambiar entre aplicaciones de Android usando el carrusel de tarjetas, Firefox muestra una pantalla negra como imagen de su tarjeta cuando una pantalla relacionada con contraseñas fue la última en ser utilizada. Antes de Firefox 144, la pantalla de edición de contraseñas era visible. Esta vulnerabilidad afecta a Firefox menor que 144.

30 Sep 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) Al cambiar entre aplicaciones de Android usando el carrusel de tarjetas, Firefox muestra una pantalla negra como imagen de su tarjeta cuando una pantalla relacionada con contraseñas fue la última en ser utilizada. Antes de Firefox 144, la pantalla de edición de contraseñas era visible. Esta vulnerabilidad afecta a Firefox < 144.

Information

Published : 2025-10-14 13:15

Updated : 2026-10-08 12:10

NVD link : CVE-2025-11717

Mitre link : CVE-2025-11717

CVE.ORG link : CVE-2025-11717

JSON object : View

Products Affected

mozilla

firefox

google

android

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2025-11717", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11717", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-10-15T13:20:29.623113Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@mozilla.org", "affectedData": [{"vendor": "Mozilla", "product": "Firefox", "versions": [{"status": "unaffected", "version": "144", "versionType": "rpm", "lessThanOrEqual": "*"}]}]}], "published": "2025-10-14T13:15:38.033", "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1872601", "tags": ["Issue Tracking", "Permissions Required"], "source": "security@mozilla.org"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-81/", "tags": ["Vendor Advisory"], "source": "security@mozilla.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "When switching between Android apps using the card carousel Firefox shows a black screen as its card image when a password-related screen was the last one being used. Prior to Firefox 144 the password edit screen was visible. This vulnerability was fixed in Firefox 144."}, {"lang": "es", "value": "Al cambiar entre aplicaciones de Android usando el carrusel de tarjetas, Firefox muestra una pantalla negra como imagen de su tarjeta cuando una pantalla relacionada con contrase\u00f1as fue la \u00faltima en ser utilizada. Antes de Firefox 144, la pantalla de edici\u00f3n de contrase\u00f1as era visible. Esta vulnerabilidad afecta a Firefox menor que 144."}], "lastModified": "2026-10-08T12:10:00.217", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DC554AD6-8F3F-4C92-85EA-C204204E9E9D", "versionEndExcluding": "144.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:google:android:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "security@mozilla.org"}