CVE-2025-5020: 
NixOS vulnerability analysis and mitigation

CVE-2025-5020 is a security vulnerability discovered and disclosed on May 21, 2025, affecting Firefox for iOS versions below 139. The vulnerability allows attackers to spoof website addresses when opening maliciously-crafted URLs with non-HTTP schemes from other applications such as Safari into the Firefox iOS client (Mozilla Advisory, NVD).

The vulnerability is classified as CWE-939 (Improper Authorization in Handler for Custom URL Scheme) with a CVSS 3.1 Base Score of 4.3 (MEDIUM) and vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. The issue specifically involves the handling of non-HTTP URL schemes that are used internally by the Firefox iOS client (NVD).

The vulnerability enables attackers to perform website address spoofing under specific conditions, potentially misleading users about the actual destination of URLs. The impact is considered low severity but could affect user trust and security awareness when interacting with URLs opened from external applications (Mozilla Advisory).

Users should update to Firefox for iOS version 139 or later to address this vulnerability. The issue has been fixed in the latest release, and no alternative workarounds have been published (Mozilla Advisory).