{"id":"CVE-2025-8042","aliases":["EUVD-2025-25232","GHSA-86q6-8hr2-487f","UBUNTU-CVE-2025-8042","openSUSE-SU-2025:15386-1","openSUSE-SU-2026:11373-1"],"status":"published","title":"Sandboxed iframe could start downloads","description":"Firefox for Android allowed a sandboxed iframe without the `allow-downloads` attribute to start downloads. This vulnerability was fixed in Firefox 141.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00503,"percentile":0.43365,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-732"],"published":"2025-07-23T00:00:00Z","modified":"2026-09-30T18:10:00Z","affected":[{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"141.0-1.1"}]}],"bundled":18},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"firefox-esr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.0-1.1"}]}],"bundled":228}],"products":[{"vendor":"mozilla","product":"firefox"}],"references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1791322","tags":["Issue Tracking","Permissions Required"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2025-56/","tags":["Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-8042"},{"url":"https://www.mozilla.org/security/advisories/mfsa2025-56"},{"url":"https://github.com/advisories/GHSA-86q6-8hr2-487f"},{"url":"https://ubuntu.com/security/CVE-2025-8042","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-8042","tags":["report"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2025-56/#CVE-2025-8042","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8027","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8028","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8029","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8030","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8031","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8034","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8035","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8036","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8040","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8041","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8043","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8044","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-10468","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-11700","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-11701","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-11702","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-11703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-11705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-11706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-11708","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-7523","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-7530","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8388","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8389","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9391","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9395","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9936","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9956","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-0244","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-0245","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-0246","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-0247","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1019","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1020","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-10530","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-10531","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-10534","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-10535","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-11152","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-11153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-11716","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-11717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-11718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-11719","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-11720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-11721","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-12380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13012","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13013","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13016","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13017","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13019","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13020","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13021","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13022","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13023","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13024","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13025","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13026","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13027","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-14326","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-14332","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-14860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-14861","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1939","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1940","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1941","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1942","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1943","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3031","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3034","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3035","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3608","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4082","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4083","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4085","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4087","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4090","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4091","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-49709","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-49710","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5270","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5271","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5272","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-9186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-9187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-0881","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-0888","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-0889","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-0892","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-10701","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-10702","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12293","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12300","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12301","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12316","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12317","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12318","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12319","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12320","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12321","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12322","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12323","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12326","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14241","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16364","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16365","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16366","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16367","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16370","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16372","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16373","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16376","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16378","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16382","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16384","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16385","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16388","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16389","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16393","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16394","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16395","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16397","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16398","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16399","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16400","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16402","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16404","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16406","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16408","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16409","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16410","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16411","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2794","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2796","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2797","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2799","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2800","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2801","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2802","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2803","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2804","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2805","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2807","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3847","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4722","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4723","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4724","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4725","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4726","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4727","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4728","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4729","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-5733","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-5735","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6746","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6747","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6748","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6749","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6750","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6751","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6753","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6754","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6755","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6756","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6757","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6758","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6759","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6760","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6761","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6762","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6763","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6764","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6765","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6766","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6767","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6768","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6769","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6770","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6771","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6772","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6773","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6774","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6775","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6776","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6777","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6778","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6779","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6780","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6781","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6782","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6784","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6785","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6786","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7324","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8093","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8951","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8960","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8963","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8965","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8966","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8967","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8971","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8972","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8973","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-8042","title":"Sandboxed iframe could start downloads","description":"Firefox for Android allowed a sandboxed iframe without the `allow-downloads` attribute to start downloads. This vulnerability was fixed in Firefox 141.","status":"published","published":"2025-08-19T20:52:46.674Z","modified":"2026-04-13T14:31:31.459Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:32:38.351095Z"}],"euvd":[{"id":"EUVD-2025-25232","description":"Firefox for Android allowed a sandboxed iframe without the `allow-downloads` attribute to start downloads. This vulnerability was fixed in Firefox 141.","status":"published","published":"2025-08-19T20:52:46Z","modified":"2026-04-13T14:31:31Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:24:27.958964Z"}],"ghsa":[{"id":"GHSA-86q6-8hr2-487f","title":"Firefox for Android allowed a sandboxed iframe without the `allow-downloads` attribute to start...","description":"Firefox for Android allowed a sandboxed iframe without the `allow-downloads` attribute to start downloads. This vulnerability affects Firefox \u003c 141.","status":"published","published":"2025-08-19T21:30:37Z","modified":"2025-08-20T18:30:20Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T15:03:21.511205Z"}],"nvd":[{"id":"CVE-2025-8042","description":"Firefox for Android allowed a sandboxed iframe without the `allow-downloads` attribute to start downloads. This vulnerability was fixed in Firefox 141.","status":"published","published":"2025-08-19T21:15:29.383Z","modified":"2026-09-30T18:10:00.19Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:11:24.730342Z"}],"osv":[{"id":"openSUSE-SU-2025:15386-1","title":"MozillaFirefox-141.0-1.1 on GA media","description":"These are all security issues fixed in the MozillaFirefox-141.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-26T00:00:00Z","modified":"2026-03-23T04:53:42.582919Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2026:11373-1","title":"firefox-esr-153.0-1.1 on GA media","description":"These are all security issues fixed in the firefox-esr-153.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-25T00:00:00Z","modified":"2026-07-26T13:30:06.696244383Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"UBUNTU-CVE-2025-8042","description":"[Unknown description]","status":"withdrawn","published":"2025-07-23T00:00:00Z","modified":"2025-07-24T07:15:56.88933Z","updated_at":"2026-11-02T16:55:55.926217Z"}]}}