Firefox for Android allowed a sandboxed iframe without the `allow-downloads` attribute to start downloads. This vulnerability affects Firefox versions prior to 141. The issue poses significant risks to users by enabling unauthorized downloads through compromised iframes.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.8 | CVE-2025-8042 |
Exploitation
To exploit this vulnerability, an attacker can create a malicious webpage that includes a sandboxed iframe without the `allow-downloads` attribute. When a user visits this page using an affected version of Firefox for Android, the iframe can initiate downloads without user consent, potentially leading to the installation of harmful files.
Affected Products
- Firefox for Android: Versions prior to 141 are affected by this vulnerability, allowing unauthorized downloads through sandboxed iframes.
Mitigation
To mitigate this vulnerability, users should update their Firefox for Android to version 141 or later. Additionally, web developers should ensure that sandboxed iframes include the `allow-downloads` attribute when necessary to prevent unauthorized downloads.