CVE-2025-8042: 
NixOS vulnerability analysis and mitigation

CVE-2025-8042 is a security vulnerability discovered in Firefox for Android that was disclosed on July 22, 2025. The vulnerability allows a sandboxed iframe without the allow-downloads attribute to initiate downloads, which violates the intended security restrictions. This vulnerability affects versions of Firefox prior to version 141 (Mozilla Advisory, NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (Critical) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The issue stems from improper permission handling in Firefox for Android's iframe sandbox implementation, specifically related to the allow-downloads attribute. The vulnerability is classified under CWE-732 (Incorrect Permission Assignment for Critical Resource) (NVD).

The vulnerability has been rated as having a moderate impact by Mozilla. The security flaw could potentially allow malicious websites to bypass security restrictions and initiate unauthorized downloads through sandboxed iframes, which could lead to security implications for affected Android users (Mozilla Advisory).

While specific exploit details are not publicly available, the vulnerability has been assigned a critical CVSS score indicating high exploitability. The attack vector is network-accessible, requires low attack complexity, and needs no privileges or user interaction to exploit (NVD).

The vulnerability has been patched in Firefox version 141. Users are advised to update their Firefox for Android installations to version 141 or later to mitigate this security risk (Mozilla Advisory).

The vulnerability was discovered and reported by security researcher Axel Chong (@Haxatron). The discovery has been acknowledged in Mozilla's security advisory, highlighting the ongoing collaboration between security researchers and browser vendors in identifying and addressing security vulnerabilities (Mozilla Advisory).