CVE-2025-1935 is a clickjacking vulnerability in Mozilla Firefox where a malicious web page could deceive a user into designating that site as the default handler for a custom URL protocol. This could lead to unintended protocol handling behavior initiated by the user. The vulnerability was addressed and fixed in Firefox 136 and Firefox ESR 128.8. It has a CVSS 3.1 base score of 4.3 (medium severity) with an attack vector of network, low attack complexity, no privileges required, user interaction required, and limited confidentiality impact. The fix is included in the Mozilla security advisories MFSA 2025-14 and MFSA 2025-16.

The impact of this vulnerability is limited to a user being tricked into setting a malicious site as the default handler for a custom URL protocol, which could lead to unexpected behavior when such protocols are invoked. There is no direct impact on integrity or availability, and no evidence of exploitation in the wild. The vulnerability requires user interaction and does not allow remote code execution or privilege escalation by itself.

This vulnerability has been fixed in Mozilla Firefox 136 and Firefox ESR 128.8. Users and administrators should update to these versions or later to remediate the issue. No additional mitigation is required beyond applying the official update from Mozilla.