CVE-2025-11717: 
NixOS vulnerability analysis and mitigation

CVE-2025-11717 is a security vulnerability affecting Firefox versions prior to 144 on Android devices. The vulnerability was discovered by researcher 'msd' and disclosed on October 14, 2025. The issue specifically affects how Firefox handles password-related screens in the Android card carousel view (Mozilla Advisory, NVD).

The vulnerability occurs when switching between Android apps using the card carousel feature. When a password-related screen was the last one being used, Firefox prior to version 144 would display the password edit screen instead of showing a black screen, potentially exposing sensitive information. The issue has been assessed with a moderate impact rating by Mozilla (Mozilla Advisory).

The primary security impact is the potential exposure of password-related information when switching between Android apps. Instead of properly hiding sensitive data, the password edit screen remained visible in the card carousel view, which could lead to unauthorized access to password information (Mozilla Advisory).

The vulnerability has been fixed in Firefox version 144. Users are advised to update to this version or later to receive the security fix. The fix implements proper screen masking when password-related screens are visible in the Android card carousel (Mozilla Advisory).