1970151 - (CVE-2025-6428) For URLs including a "link" parameter, Firefox navigates to the value of "link" instead of opening the domain

Status: RESOLVED FIXED

(Firefox for Android :: General, defect)

Description

[Raul Bucata]

Environment:
Operating system: Android 13
Firefox version: Firefox Mobile 139.0

Steps to reproduce:

1. Navigate to: https://tweakers.net/pricewatch/2181424/samsung-galaxy-a56-5g-256gb-opslag-grijs.html
2. Dismiss the cookie policy
3. Tap on any price link or website link and observe

Expected Behavior:
A new page is opened

Actual Behavior:
Nothing happens

Notes:

• Reproduces regardless of the status of ETP
• Reproduces in firefox-nightly, and firefox-release
• Does not reproduce in chrome

Created from https://github.com/webcompat/web-bugs/issues/159810

Comment 1

[Raul Bucata]

Attachment: Chr vs FF Android

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

Since nightly and release are affected, beta will likely be affected too.
For more information, please visit BugBot documentation.

Comment 3

[kees]

Apperently any link with the get parameter 'link' in it doesn't work anymore. So "https://tweakers.net/?link=test" is broken, but "https://tweakers.net/?plink=test" works

Comment 4

[crisp]

Note that we at Tweakers have adjusted the GET parameter in these links to tlink= in order to make the links work again in Firefox on Android.

As far as I can tell both version 139 of Firefox for Android and the 140.0 beta version are affected. Users report that Firefox on iOS is not affected. Also desktop version of Firefox does not seem to have this issue.

Comment 5

[Dennis Schubert [:denschub]]

If comment 3 is true, that would be concerning. ni? myself to try to build a testcase here.

Comment 6

[crisp]

Here is a simple testcase: https://tweakers.net/~kees/link-test.html
The first three links don't work in Firefox 139 on Android

Comment 7

[Alex Helvetica]

This doesn't just prevent Firefox Android users from accessing links with a 'link' URI parameters, it instead opens to the link parameter, which potentially could be a malicious website.

It works for external links (Eg, a user clicks a link in an email from their mail client like K-9, and that opens in Firefox), as well as embedded links from inside of webpages.

All these links link to my website (https://gingernut.helevtica.systems) on Firefox Android (139.0.4), even though the URL domain is http://test.local.

'link' URI parameter

http://test.local/?link=https://gingernut.helvetica.systems

A preceding parameter and 'link' parameter

http://test.local/?test=true&link=https://gingernut.helvetica.systems

'link' parameter and a following parameter

http://test.local/?link=https://gingernut.helvetica.systems&foo=bar

Unsafe characters in 'link' parameter are URI encoded

http://test.local/?link=http%3A%2F%2Fgingernut%2ehelvetica%2esystems

All characters in 'link' parameter are URI encoded

http://test.local/?link=%68%74%74%70%3A%2F%2F%67%69%6E%67%65%72%6E%75%74%2E%68%65%6C%76%65%74%69%63%61%2E%73%79%73%74%65%6D%73

All characters in 'link' parameter are URI encoded, with a preceding and following parameter

http://test.local/?test=true&link=%68%74%74%70%3A%2F%2F%67%69%6E%67%65%72%6E%75%74%2E%68%65%6C%76%65%74%69%63%61%2E%73%79%73%74%65%6D%73&foo=bar

An example of a phishing scam, which URL is from the Australian Tax Office domain, but Firefox Android actually opens a Rick Ashley video on YouTube

https://ato.gov.au/?foo=bar&https://ato.gov.au/?foo=bar&link=%68%74%74%70%73%3A%2F%2F%77%77%77%2E%79%6F%75%74%75%62%65%2E%63%6F%6D%2F%77%61%74%63%68%3F%76%3D%64%51%77%34%77%39%57%67%58%63%51&isLegitLink=false

Comment 8

[Francesco Lodolo [:flod]]

This doesn't look like a webcompat problem.

Comment 9

[Markus Stange [:mstange]]

Likely a regression from bug 1942509, given that the patch there added a test with the URL "https://example.com/?link=https://example.com"

Comment 10

[Roger Yang [:royang]]

Yes, that is the correct cause of the regression. This was trying to recover the Google map case but not suppose to load the link parameter unless the original url couldn't be loaded. I'll revert and request uplift. Thanks

Comment 11

[Roger Yang [:royang]]

I will remove both afl and link parameter fallback support until I figure out a better way to support them.

Comment 12

[Roger Yang [:royang]]

Unfortunately, lots of conflicts since the change landed for a while now. I'll manually revert.

Comment 13

[Roger Yang [:royang]]

Attachment: Bug 1970151 - Do not use afl and link parameter as fallback.

Comment 14

[Roger Yang [:royang]]

Created a safe change that we can uplift with minimal risk.

Comment 15

[Roger Yang [:royang]]

Attachment: Bug 1970151 - Do not use afl and link parameter as fallback.

Original Revision: https://phabricator.services.mozilla.com/D253746

Comment 16

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/1600b429548b
https://hg.mozilla.org/integration/autoland/rev/ba2a7f5e5535
Do not use afl and link parameter as fallback. r=android-reviewers,nalexander

Comment 17

[Phabricator Automation]

firefox-beta Uplift Approval Request

• User impact if declined: Incorrect URL can be loaded.
• Code covered by automated testing: yes
• Fix verified in Nightly: no
• Needs manual QE test: no
• Steps to reproduce for manual QE testing: Load example URLs in the Bugzilla issue and make sure that the correct URL is loaded.
• Risk associated with taking this patch: Low risk
• Explanation of risk level: fallback URL will not be used if the user decides not to redirect to external app.
• String changes made/needed: None
• Is Android affected?: yes

Comment 18

[Pulsebot]

https://github.com/mozilla-firefox/firefox/commit/57776c658964
https://hg.mozilla.org/releases/mozilla-beta/rev/b5d8f0cf9f89

Comment 19

[Mira Lobontiu (Android QA)]

I was able to reproduce this issue on 139.0.4 Firefox for Android, and on Firefox for Android Beta 140.0b9 with Samsung Galaxy S24 (Android 15).
Not reproducible on 141.0a1 Nightly from 6/15.

Comment 20

[Cristian Tuns]

https://hg.mozilla.org/mozilla-central/rev/ba2a7f5e5535

Comment 21

[Mira Lobontiu (Android QA)]

Verified on the latest Firefox for Android 140.0 build 1, and on Beta 140.0b10 with the following devices:

• Samsung Galaxy S24 (Android 15),
• Lenovo tablet (Android 10),
• Realme GT Master Edition (Android 13), and
• Google Pixel 6 (Android 16).

Comment 22

[Tom Ritter [:tjr] (one week until extended leave)]

Attachment: advisory.txt