Malicious pages could use Firefox for iOS to pass FIDO: links to the OS and trigger the hybrid passkey transport. An attacker within Bluetooth range could have used this to trick the user into using their passkey to log the attacker’s computer into the target account. This vulnerability affects Firefox for iOS < 142 and Focus for iOS < 142.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.8 | CVE-2025-55031 |
Exploitation
To exploit this vulnerability, an attacker within Bluetooth range can create a malicious webpage that utilizes FIDO links to interact with the Firefox for iOS application. By tricking the user into visiting this page, the attacker can potentially gain unauthorized access to the user’s accounts by capturing their passkey.
Affected Products
- Firefox for iOS: A web browser for iOS devices that is vulnerable to passkey exploitation if the version is below 142.
- Focus for iOS: A privacy-focused browser for iOS that shares the same vulnerability as Firefox for iOS when below version 142.
Mitigation
To mitigate this vulnerability, users should update their Firefox for iOS and Focus for iOS applications to version 142 or later. Additionally, users should be cautious when interacting with unknown Bluetooth devices and avoid visiting suspicious links.