CVE-2025-55030: 
NixOS vulnerability analysis and mitigation

Firefox for iOS version 142 and earlier versions contain a security vulnerability (CVE-2025-55030) discovered and disclosed on August 19, 2025. The vulnerability stems from Firefox for iOS not properly respecting Content-Disposition headers of type Attachment, causing the browser to incorrectly display content inline instead of downloading it (Mozilla Advisory).

The vulnerability is rated with a CVSS v3.1 Base Score of 6.1 (Medium), with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. This indicates that the vulnerability requires network access and user interaction, with no privileges required. The attack complexity is low, and it can affect confidentiality and integrity at a low level, with no impact on availability (AttackerKB).

The vulnerability could potentially allow for Cross-Site Scripting (XSS) attacks when content is incorrectly displayed inline rather than being downloaded. This improper handling of Content-Disposition headers could lead to unauthorized access to user data and potential manipulation of web content (Mozilla Advisory).

Users are advised to update to Firefox for iOS version 142 or later, which contains the fix for this vulnerability. Mozilla has released this security update as part of their August 2025 security updates (Mozilla Advisory).