1946062 - (CVE-2025-54144) iOS Firefox URI with open-text allows to load internal URIs, localhost attack vectors and arbitrary schemes

Status: VERIFIED FIXED

(Firefox for iOS :: General, defect)

Description

[James Lee]

1. Internal URIs like about

firefox://open-text?text=about://

2. localhost scheme that could be used for dangerous exploits like bug 1850019

bug 1850019 is localhost reader mode feature abusing bugs http://localhost:6571 which can't be opened from open-url or in iOS Firefox from web, but only this way for possibly further exploitation chain purpose with http://localhost:6571 reader mode vulnerabilities.

3. abcd://, tel:// etc any arbitrary schemes

We are able to open any schemes through open-text like abcd:// tel:// or whatever.

I'll add further details to follow up.

Comment 1

[James Lee]

Attachment: open-text.html

Please open following link from Safari or other apps and click on the link.

Comment 2

[Daniel Veditz [:dveditz]]

Same as bug 1946044: these actions are equivalent to the USER copying the link and then pasting into a new tab. We prevent web content from opening these, but the user can try what they want.

Comment 3

[James Lee]

Hi, that's not the case since you're opening it from safari as I explained in comment 1, which is like bug 1850158 and bug 1870384 . This one need to be re-opened.

Comment 4

[Daniel Veditz [:dveditz]]

Hi, that's not the case since you're opening it from safari as I explained in comment 1,

In comment 1 you talked about a single URL, which was also in your POC, and then some alternate schemes which we let people type into the URL bar and execute. point 2 was handwavy stuff about some other bug -- is there a POC? Could a user type that URL into the address bar and trigger the same behavior?

I'll reopen to see if you can write a demonstration of what you're talking about. But the principle here is: if the user can type that URL into the addressbar and open it then it's perfectly acceptable for a long-press-open to also open that URL. If it's bad that the user can type that URL into the addressbar then it's a bug about not letting the user load that URL, not a bug about a long-press on the context menu.

Comment 5

[James Lee]

comment 1 is linked URL like in bug 1850158 to launch it from Safari and other apps. (which there're several ways to open them automatically from Firefox, Muneaki also mentioned one in that report)

This open-text is same as open-url which is param for opening URI, so this is not a duplicate to bug 1946044 and users have no idea where they're going to other than opening Firefox app like bug 1850158 and my duplicate but different internal URI opening issue bug 1870384. This is an incomplete fix of bug 1850158 where allowing http/https only has been fixed for open-url but NOT for open-text.

I'll attach gif or mp4 showing this issue.

Comment 6

[mreagan]

Some aspects of this ticket still aren't entirely clear, but based on what I'm understanding from the discussion above it seems like the fundamental problem is that we're allowing schemes to be included with open-text URLs, which opens the related text query as a URL, even though open-text is intended (AFAICS) to be used for search queries shared to Firefox externally.

For example this is obviously fine:

firefox://open-text?text=about

this is problematic:

firefox://open-text?text=about://

So I believe the fix here is for us to ensure we don't open search text queries with open-text as website URLs. But if I'm missing anything else critical please LMK.

Comment 7

[mreagan]

Note for testing/QA:

1. Have a website with a link such as firefox://open-text?text=about:// (DM me if needed I can provide a test site for this)
2. Visit that page in Safari on iOS
3. Click link

Expected: Firefox should open with a search result page
Actual (before fix): Firefox would open to the about:// blank page

Comment 8

[mreagan]

Attachment: advisory.txt

Comment 9

[Daniel Veditz [:dveditz]]

We have reserved CVE-2025-54144 for this issue

Comment 10

[Andrei Bodea[:andrei]]

Verified as fixed on v9000 (58916) with iPhone 15 Pro (18.5).

• video