This vulnerability involves sandboxed iframes in Firefox for iOS potentially enabling unauthorized downloads to the device by circumventing sandbox restrictions declared on the parent page. The flaw undermines the sandbox security mechanism intended to isolate iframe content and prevent such actions. Mozilla addressed this issue in Firefox for iOS 141, as documented in their security advisory MFSA 2025-60. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

If exploited, this vulnerability could allow an attacker to cause a sandboxed iframe to download files onto the victim's iOS device without proper authorization or user consent, potentially leading to compromise of device integrity or confidentiality. However, Mozilla rates the impact as moderate, possibly reflecting mitigations or the context of the iOS environment. There are no known active exploits reported.

Mozilla has released an official fix for this vulnerability in Firefox for iOS version 141. Users and administrators should update to this version or later to remediate the issue. Since the vulnerability is fixed, no additional mitigation steps are required beyond applying the update.