CVE-2025-27425: 
NixOS vulnerability analysis and mitigation

CVE-2025-27425 is a security vulnerability discovered in Firefox for iOS versions prior to 136. The vulnerability, reported by Abhinav Khanna, involves a QR code user confirmation bypass with invalid protocol. The issue was disclosed on February 24, 2025, and affects the way Firefox for iOS handles QR codes containing website URLs (Mozilla Advisory).

The vulnerability allows scanning certain QR codes containing text with website URLs to bypass the normal confirmation alert process. This bypass occurs when processing QR codes with specific URL formats, resulting in automatic URL opening without user confirmation. The vulnerability has been assigned a CVSS 3.1 Base Score of 4.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. It has been classified under CWE-287 (Improper Authentication) (NVD).

The vulnerability has been rated as having a low impact by Mozilla. The primary security concern is that it could allow malicious QR codes to open website URLs automatically without presenting users with the expected confirmation alert, potentially leading to unwanted website access (Mozilla Advisory).

The vulnerability has been fixed in Firefox for iOS version 136. Users are advised to update their Firefox for iOS application to the latest version to receive the security fix (Mozilla Advisory).