Information disclosure in Firefox for Android and Mozilla Firefox - CVE-2025-3035

Vulnerability identifier: #VU106363

CSH Severity: Low

CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-3035

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the tab title can be leaked when using the AI chatbot in one tab and later activating it in another tab. A remote attacker can gain access to title of a previous tab.

Firefox for Android
Mozilla Firefox
Gentoo Linux
Fedora
www-client/firefox
www-client/firefox-bin
firefox

Install updates from vendor's website.

Firefox for Android - update to 137.0
Mozilla Firefox - update to 137.0
www-client/firefox - update to 60.8.0
www-client/firefox-bin - update to 60.8.0
firefox - addressed in versions 137.0-2.fc40, 137.0-2.fc41, 137.0-2.fc42

• https://bugzilla.mozilla.org/show_bug.cgi?id=1952268
• https://www.mozilla.org/security/advisories/mfsa2025-20/

• Multiple vulnerabilities in Mozilla Firefox and Firefox ESR
• Fedora 41 update for firefox
• Fedora 40 update for firefox
• Fedora 42 update for firefox
• Gentoo update for Mozilla Firefox