This vulnerability involves the use of Unicode RTLO characters to manipulate how filenames are displayed in the Firefox for iOS downloads UI, enabling filename spoofing. This could mislead users into saving files that appear to be of one type but are actually of another, potentially increasing the risk of executing malicious files. The flaw is tracked as CWE-451 (Incorrect Expression of Filename or Path). Mozilla fixed this issue in Firefox for iOS 144.0, which was released on October 12, 2025. The advisory was published later on December 16, 2025, after the fix was already available.

The vulnerability allows an attacker to spoof filenames in the downloads UI, potentially tricking users into saving files with unexpected file types. This could lead to users inadvertently opening malicious files. However, the vendor rates the impact as low, and there are no known exploits in the wild. The CVSS score is 6.5 (medium severity), reflecting the potential for user interface deception leading to impact on integrity but no direct confidentiality or availability impact.

A fix for this vulnerability is available and was included in Firefox for iOS version 144.0, released on October 12, 2025. Users and administrators should ensure that Firefox for iOS is updated to version 144.0 or later to mitigate this issue. Since the vendor advisory confirms the fix is already released, no additional mitigation steps are required beyond applying the update.