Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been be bypassed (distinct from CVE-2025-0245). This vulnerability was fixed in Firefox 136.

zetlyn/cve-nvd vulnerability cve CVE-2025-1941 cpe cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* known 2025-03-04

https://nvd.nist.gov/vuln/detail/CVE-2025-1941

Properties

cvss	9.1 receipt Source NVD Its words `9.1` Read by `field:cve.metrics.cvssMetricV31[].cvssData.baseScore` Said since 2026-10-02 12:00 UTC Last answered 2026-10-04 18:16 UTC Original open at the source What the source handed over { "cve": { "affected": [ { "affectedData": [ { "product": "Firefox", "vendor": "Mozilla", "versions": [ { "lessThanOrEqual": "", "status": "unaffected", "version": "136", "versionType": "rpm" } ] } ], "source": "security@mozilla.org" } ], "configurations": [ { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:a:mozilla:firefox::::::::*", "matchCriteriaId": "7DB4CDD0-EC54-43D0-ACB2-F159ABA53D2C", "versionEndExcluding": "136.0", "vulnerable": true } ], "negate": false, "operator": "OR" } ] } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been be bypassed (distinct from CVE-2025-0245). This vulnerability was fixed in Firefox 136." }, { "lang": "es", "value": "En determinadas circunstancias, se podría haber omitido una configuración de usuario que indicaba que Focus debía requerir autenticación antes de su uso (distinto de CVE-2025-0245). Esta vulnerabilidad afecta a Firefox < 136." } ], "id": "CVE-2025-1941", "lastModified": "2026-09-30T19:10:01.007", "metrics": { "cvssMetricV31": [ { "cvssData": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary" } ], "ssvcV203": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": { "id": "CVE-2025-1941", "options": [ { "exploitation": "none" }, { "automatable": "yes" }, { "technicalImpact": "total" } ], "role": "CISA Coordinator", "timestamp": "2025-03-04T15:46:47.298162Z", "version": "2.0.3" } } ] }, "published": "2025-03-04T14:15:39.063", "references": [ { "source": "security@mozilla.org", "tags": [ "Issue Tracking" ], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1944665" }, { "source": "security@mozilla.org", "tags": [ "Vendor Advisory" ], "url": "https://www.mozilla.org/security/advisories/mfsa2025-14/" } ], "sourceIdentifier": "security@mozilla.org", "vulnStatus": "Modified", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-284" } ], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary" } ] } }
product	Firefox receipt Source NVD Its words `Firefox` Read by `field:cve.affected[].affectedData[].product` Said since 2026-10-02 12:00 UTC Last answered 2026-10-04 18:16 UTC Original open at the source What the source handed over { "cve": { "affected": [ { "affectedData": [ { "product": "Firefox", "vendor": "Mozilla", "versions": [ { "lessThanOrEqual": "", "status": "unaffected", "version": "136", "versionType": "rpm" } ] } ], "source": "security@mozilla.org" } ], "configurations": [ { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:a:mozilla:firefox::::::::*", "matchCriteriaId": "7DB4CDD0-EC54-43D0-ACB2-F159ABA53D2C", "versionEndExcluding": "136.0", "vulnerable": true } ], "negate": false, "operator": "OR" } ] } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been be bypassed (distinct from CVE-2025-0245). This vulnerability was fixed in Firefox 136." }, { "lang": "es", "value": "En determinadas circunstancias, se podría haber omitido una configuración de usuario que indicaba que Focus debía requerir autenticación antes de su uso (distinto de CVE-2025-0245). Esta vulnerabilidad afecta a Firefox < 136." } ], "id": "CVE-2025-1941", "lastModified": "2026-09-30T19:10:01.007", "metrics": { "cvssMetricV31": [ { "cvssData": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary" } ], "ssvcV203": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": { "id": "CVE-2025-1941", "options": [ { "exploitation": "none" }, { "automatable": "yes" }, { "technicalImpact": "total" } ], "role": "CISA Coordinator", "timestamp": "2025-03-04T15:46:47.298162Z", "version": "2.0.3" } } ] }, "published": "2025-03-04T14:15:39.063", "references": [ { "source": "security@mozilla.org", "tags": [ "Issue Tracking" ], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1944665" }, { "source": "security@mozilla.org", "tags": [ "Vendor Advisory" ], "url": "https://www.mozilla.org/security/advisories/mfsa2025-14/" } ], "sourceIdentifier": "security@mozilla.org", "vulnStatus": "Modified", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-284" } ], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary" } ] } }
status	Modified receipt Source NVD Its words `Modified` Read by `field:cve.vulnStatus` Said since 2026-10-02 12:00 UTC Last answered 2026-10-04 18:16 UTC Original open at the source What the source handed over { "cve": { "affected": [ { "affectedData": [ { "product": "Firefox", "vendor": "Mozilla", "versions": [ { "lessThanOrEqual": "", "status": "unaffected", "version": "136", "versionType": "rpm" } ] } ], "source": "security@mozilla.org" } ], "configurations": [ { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:a:mozilla:firefox::::::::*", "matchCriteriaId": "7DB4CDD0-EC54-43D0-ACB2-F159ABA53D2C", "versionEndExcluding": "136.0", "vulnerable": true } ], "negate": false, "operator": "OR" } ] } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been be bypassed (distinct from CVE-2025-0245). This vulnerability was fixed in Firefox 136." }, { "lang": "es", "value": "En determinadas circunstancias, se podría haber omitido una configuración de usuario que indicaba que Focus debía requerir autenticación antes de su uso (distinto de CVE-2025-0245). Esta vulnerabilidad afecta a Firefox < 136." } ], "id": "CVE-2025-1941", "lastModified": "2026-09-30T19:10:01.007", "metrics": { "cvssMetricV31": [ { "cvssData": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary" } ], "ssvcV203": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": { "id": "CVE-2025-1941", "options": [ { "exploitation": "none" }, { "automatable": "yes" }, { "technicalImpact": "total" } ], "role": "CISA Coordinator", "timestamp": "2025-03-04T15:46:47.298162Z", "version": "2.0.3" } } ] }, "published": "2025-03-04T14:15:39.063", "references": [ { "source": "security@mozilla.org", "tags": [ "Issue Tracking" ], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1944665" }, { "source": "security@mozilla.org", "tags": [ "Vendor Advisory" ], "url": "https://www.mozilla.org/security/advisories/mfsa2025-14/" } ], "sourceIdentifier": "security@mozilla.org", "vulnStatus": "Modified", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-284" } ], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary" } ] } }
vendor	Mozilla receipt Source NVD Its words `Mozilla` Read by `field:cve.affected[].affectedData[].vendor` Said since 2026-10-02 12:00 UTC Last answered 2026-10-04 18:16 UTC Original open at the source What the source handed over { "cve": { "affected": [ { "affectedData": [ { "product": "Firefox", "vendor": "Mozilla", "versions": [ { "lessThanOrEqual": "", "status": "unaffected", "version": "136", "versionType": "rpm" } ] } ], "source": "security@mozilla.org" } ], "configurations": [ { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:a:mozilla:firefox::::::::*", "matchCriteriaId": "7DB4CDD0-EC54-43D0-ACB2-F159ABA53D2C", "versionEndExcluding": "136.0", "vulnerable": true } ], "negate": false, "operator": "OR" } ] } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been be bypassed (distinct from CVE-2025-0245). This vulnerability was fixed in Firefox 136." }, { "lang": "es", "value": "En determinadas circunstancias, se podría haber omitido una configuración de usuario que indicaba que Focus debía requerir autenticación antes de su uso (distinto de CVE-2025-0245). Esta vulnerabilidad afecta a Firefox < 136." } ], "id": "CVE-2025-1941", "lastModified": "2026-09-30T19:10:01.007", "metrics": { "cvssMetricV31": [ { "cvssData": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary" } ], "ssvcV203": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": { "id": "CVE-2025-1941", "options": [ { "exploitation": "none" }, { "automatable": "yes" }, { "technicalImpact": "total" } ], "role": "CISA Coordinator", "timestamp": "2025-03-04T15:46:47.298162Z", "version": "2.0.3" } } ] }, "published": "2025-03-04T14:15:39.063", "references": [ { "source": "security@mozilla.org", "tags": [ "Issue Tracking" ], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1944665" }, { "source": "security@mozilla.org", "tags": [ "Vendor Advisory" ], "url": "https://www.mozilla.org/security/advisories/mfsa2025-14/" } ], "sourceIdentifier": "security@mozilla.org", "vulnStatus": "Modified", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-284" } ], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary" } ] } }

Text

Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been be bypassed (distinct from CVE-2025-0245). This vulnerability was fixed in Firefox 136. En determinadas circunstancias, se podría haber omitido una configuración de usuario que indicaba que Focus debía requerir autenticación antes de su uso (distinto de CVE-2025-0245). Esta vulnerabilidad afecta a Firefox < 136.