CVE-2023-25749: 
NixOS vulnerability analysis and mitigation

CVE-2023-25749 is a security vulnerability affecting Firefox for Android versions prior to 111.0. The vulnerability allows Android applications with unpatched vulnerabilities to be launched from the browser using Intents without user confirmation, potentially exposing users to these vulnerabilities (Mozilla Advisory).

The vulnerability has been assigned a CVSS v3.1 Base Score of 4.3 (MEDIUM) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. This indicates that the vulnerability can be exploited over the network, requires low attack complexity, needs no privileges, but does require user interaction (NVD).

The vulnerability could expose users to potential security risks when external Android applications with known vulnerabilities are launched from the browser without explicit user consent. This specifically affects Firefox for Android users, while other versions of Firefox remain unaffected (Mozilla Advisory).

Mozilla has addressed this vulnerability in Firefox 111 by implementing a confirmation prompt that requires users to explicitly approve the launch of external applications. Users are advised to update to Firefox 111 or later versions to receive this security fix (Mozilla Advisory).