This vulnerability (CVE-2025-11716) in Mozilla Firefox on Android allows links within sandboxed iframes to open external applications without the necessary "allow-" permission. This behavior violates sandboxing restrictions intended to limit iframe capabilities. The flaw was reported by Axel Chong and fixed in Firefox 144 and Thunderbird 144. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. The vendor advisory confirms the fix was released in Firefox 144.

The vulnerability could allow a malicious webpage embedding a sandboxed iframe to open external applications on an Android device without the explicit permission normally required. This could lead to unauthorized app launches potentially impacting user control and integrity of the device environment. There is no confidentiality or availability impact reported. The issue is limited to Firefox on Android and does not affect other platforms.

Mozilla has fixed this vulnerability in Firefox 144 and Thunderbird 144. Users and administrators should update affected Firefox installations on Android to version 144 or later to remediate this issue. Since the fix is officially released, no additional mitigation steps are required beyond applying the update.