CVE-2025-11720: 
NixOS vulnerability analysis and mitigation

The vulnerability (CVE-2025-11720) affects Firefox and Firefox Focus UI for Android custom tab feature. Discovered and disclosed on October 14, 2025, this vulnerability impacts Firefox versions prior to 144. The issue stems from the UI only displaying the 'site' that was loaded, rather than the full hostname (Mozilla Advisory, NVD).

The vulnerability is classified as a spoofing risk with low impact severity. The technical issue lies in the Android custom tab feature's UI implementation, where it fails to display the complete hostname of loaded sites. This implementation flaw could allow user-supplied content hosted on a subdomain to masquerade as content from a different subdomain of the same site (Mozilla Advisory).

The primary impact of this vulnerability is the potential for subdomain spoofing attacks. Malicious actors could host content on a subdomain and trick users into believing it originated from a different, potentially more trustworthy subdomain of the same site. This could lead to users being misled about the true source of the content they are viewing (Mozilla Advisory).

Mozilla has addressed this vulnerability in Firefox 144. Users are advised to update their Firefox and Firefox Focus installations to version 144 or later to mitigate this security risk (Mozilla Advisory).