CVE-2025-14744: 
NixOS vulnerability analysis and mitigation

CVE-2025-14744 is a filename spoofing vulnerability in Firefox for iOS caused by improper handling of Unicode Right-to-Left Override (RTLO) characters in the downloads UI. Malicious websites can exploit this to display a deceptive filename, tricking users into saving files of an unexpected or dangerous file type. It affects all versions of Firefox for iOS prior to 144.0. The vulnerability was reported by researcher Azril, fixed in Firefox for iOS 144.0 (released October 12, 2025), and the advisory (MFSA 2025-97) was published on December 15–16, 2025. It carries a CVSS v3.1 base score of 6.5 (Medium) (Mozilla Advisory).

The root cause is classified as CWE-451 (User Interface Misrepresentation of Critical Information). The Unicode RTLO character (U+202E) is a bidirectional control character that reverses the display order of subsequent text; when embedded in a filename, it causes the visible filename in the downloads UI to differ from the actual filename and extension. For example, a file named malware[U+202E]gpj.exe would appear to the user as malware.exe[reversed] — potentially displaying as malware.jpg — leading the user to believe they are saving an image when they are actually saving an executable. No authentication or special privileges are required; the attacker only needs to serve a crafted download link to a victim browsing with a vulnerable Firefox for iOS version (Mozilla Advisory).

Successful exploitation allows a malicious website to deceive iOS users into downloading and saving files whose true type is hidden, primarily impacting integrity (CVSS integrity impact: High). While there is no direct confidentiality or availability impact, the spoofing could facilitate social engineering attacks where users are tricked into opening malicious files (e.g., disguising an executable or script as a benign image or document), potentially leading to device compromise as a secondary consequence. The scope is limited to Firefox for iOS users on unpatched versions (Mozilla Advisory).

There is no public evidence of in-the-wild exploitation or weaponized exploit code for CVE-2025-14744. The EPSS score is approximately 0.025% (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — the victim must visit a malicious site and initiate a download — which limits its practical attack surface (Mozilla Advisory).

1. Craft a malicious filename: Construct a filename embedding the Unicode RTLO character (U+202E) to reverse the displayed extension, e.g., a file stored as malware_gpj.exe with RTLO inserted before gpj so it renders as malware_exe.jpg in the UI.
2. Host the file: Place the crafted file on an attacker-controlled web server with an HTTP response that triggers a download (e.g., Content-Disposition: attachment; filename="malware\u202Egpj.exe").
3. Lure the victim: Direct a Firefox for iOS user (running a version below 144.0) to the malicious page via phishing, malvertising, or a crafted link.
4. Trigger the download: The victim initiates the download; the Firefox for iOS downloads UI displays the spoofed filename (e.g., malware_exe.jpg) rather than the true filename.
5. Victim saves and opens the file: Believing the file is a harmless image or document, the victim saves and potentially opens it, executing the malicious payload (Mozilla Advisory).

Mozilla fixed this vulnerability in Firefox for iOS 144.0, released October 12, 2025. Users should update Firefox for iOS to version 144.0 or later via the Apple App Store. No configuration-based workaround is available; upgrading is the only remediation. Organizations managing iOS devices via MDM should verify that Firefox for iOS is updated to the patched version (Mozilla Advisory).

Mozilla rated this vulnerability as "low" impact in its official advisory (MFSA 2025-97), noting that the fix was included in the original Firefox for iOS 144.0 release but the advisory was not published until December 2025 because the issue was not recognized at the time of release. No significant independent researcher commentary or broad media coverage has been identified for this vulnerability beyond standard vulnerability database aggregation (Mozilla Advisory).