1973577 - (CVE-2025-55029) Popup Blocker Bypass via Tab Flood Exploit

Status: VERIFIED FIXED

(Firefox for iOS :: General, defect)

Description

[bharat]

A vulnerability in Firefox allows a malicious webpage to bypass the built-in popup blocker, resulting in the automatic opening of thousands of tabs with one click . This leads to potential denial-of-service (DoS) conditions, browser lockups, and user disruption, and may also allow for social engineering attacks if used alongside phishing content.

The behavior occurs even when the popup blocker is explicitly enabled

step to reproduce
Go to mrnoob790.github.io/Yogi.html
Click on button
Poup block bypass
Impact
Denial of Service: Entire system/browser may freeze or crash.
Popup Blocker Bypass: Security feature is bypassed.
Exploitation Vector: Malicious sites could use this to confuse users, overload memory, or deliver phishing payloads.
Usability Risk: Could make Firefox unusable until forcefully closed.

Poc-https://www.mediafire.com/file/batjxygp6xann25/ScreenRecording_06-24-2025+00-24-04_1.mp4/file

Comment 1

[bharat]

Attachment: Poc.html

Comment 2

[Andrew McCreight [:mccr8]]

I can't reproduce, either with the attachment or on the original site. The test case doesn't do anything special, it just calls window.open, so if it worked I feel like it must mean the entire popup blocker isn't working. Do you have an exception set for this site maybe?

Comment 3

[Daniel Veditz [:dveditz]]

The movie appears to show Firefox for Android, not Firefox desktop. Please be specific about that, and also what version is affected.

Go to mrnoob790.github.io/Yogi.html

It would help if you put "https://" on the front of your URLs so they get turned into something we can click. Especially on mobile where fat fingers are nowhere near as good as a mouse for selecting things.

This is the same testcase you mentioned in your Firefox for iOS bug 1927905 comment 2

Poc-https://www.mediafire.com/file/batjxygp6xann25/ScreenRecording_06-24-2025+00-24-04_1.mp4/file

A screen recording is never a Proof of Concept (PoC), especially in these days of AI-fake videos. they are sometimes useful in helping to explain what you mean if you worry we will misunderstand your words. For example, in this bug it was helpful to realize you were talking about Android since you never mentioned it, but that's 64Mb and the time it took you to create it to explain a missing 7 letter word.

Comment 4

[Daniel Veditz [:dveditz]]

Nope, it's Firefox for iOS -- the first screen went by too fast for me to see the Safari icon, and I got thrown off by demonstrating in Chrome.

This is already on file

Comment 5

[Daniel Veditz [:dveditz]]

This is duped to one I filed based on this reporter's original testcase in bug 1927905. Bharat deserves the credit

Comment 6

[Daniel Veditz [:dveditz]]

Attachment: testcase from bug 1971924 -- adjustable level of DOSing.

Comment 8

[BugBot [:suhaib / :marco]]

The severity field is not set for this bug.
:mreagan, could you have a look please?

For more information, please visit BugBot documentation.

Comment 9

[BugBot [:suhaib / :marco]]

The severity field is not set for this bug.
:mreagan, could you have a look please?

For more information, please visit BugBot documentation.

Comment 10

[BugBot [:suhaib / :marco]]

The severity field is not set for this bug.
:mreagan, could you have a look please?

For more information, please visit BugBot documentation.

Comment 11

[bharat]

Hey cve and reward ?

Comment 12

[Daniel Veditz [:dveditz]]

Denial of service bugs are excluded from our bounty program, and generally don't get a CVE in a client product

Comment 13

[Andrei Bodea[:andrei]]

Verified as fixed on v9000 (59126) with iPhone 15 Pro (18.5).
The client now opens a maximum of 2 tabs every 2 seconds (after 2 seconds, the threshold resets).
video

Comment 14

[mreagan]

Attachment: advisory.txt

Comment 15

[bharat]

(In reply to Daniel Veditz [:dveditz] from comment #12)

Denial of service bugs are excluded from our bounty program, and generally don't get a CVE in a client product

But in other browser popup bypass recive reward

Comment 16

[bharat]

Thanks because i recive reward for popup bypass in chrome that why i commented i hope firefox team also provide it

Comment 17

[bharat]

First of all thank you so much @daniel u reopened these ticket . Otherwise mostly program trigger dont do that