1984683 - (CVE-2025-14744) Filename/Extension Spoofing via Unicode Right-to-Left Override (RTLO) in Download UI - Firefox IOS

Status: VERIFIED FIXED

(Firefox for iOS :: Browser, defect)

Description

[Moch. Azril]

Attachment: spoof-rtlo.html

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:142.0) Gecko/20100101 Firefox/142.0

Steps to reproduce:

1. Open the link zriil.github.io/spoof-rtlo.html
   2.Click Download File.
2. Observe the filename in the download UI — it appears as invoiceexe.pdf even though the actual extension is .exe.

Actual results:

Actual filename: invoice\u202Efdp.exe

Expected results:

The download prompt should either:

1. Strip or escape Unicode control characters from filenames, or
2. Show the real file extension regardless of the display order.

Comment 1

[Moch. Azril]

Steps To Reproduce:

1. Open the link zriil.github.io/spoof-rtlo.html
2. Click Download File.
3. Observe the filename in the download UI — it appears as invoiceexe.pdf even though the actual extension is .exe.

Actual results:

Actual filename: invoice\u202Efdp.exe
Displayed as: invoiceexe.pdf
This can trick users into downloading and opening files they believe are safe (e.g., PDF) but are actually executable files when opened on systems that honor the real extension (such as Windows).

Comment 2

[Moch. Azril]

Attachment: poc

Comment 3

[Moch. Azril]

This issue has actually occurred before in CVE-2020-15651, but I found it again in the latest version (Firefox iOS 142.0.1 on iOS 18.5).

Comment 4

[Moch. Azril]

Hey team any update?

Comment 5

[BugBot [:suhaib / :marco]]

The severity field is not set for this bug.
:mreagan, could you have a look please?

For more information, please visit BugBot documentation.

Comment 6

[mreagan]

This appears to have been possibly fixed by an external contributor. Adding some links to hopefully help document, this ticket may have been addressed outside of our normal process for security bugs so we may need someone from iOS and/or sec team to revisit this to validate the fix and determine the procedure for a CVE etc.

https://github.com/mozilla-mobile/firefox-ios/issues/28882
https://github.com/mozilla-mobile/firefox-ios/pull/29667

Comment 7

[Andrei Bodea[:andrei]]

Verified as fixed on v146.1 (65627) with iPhone 15 Pro (iOS 18.7.2).
Following the steps from the description:

• Open the link zriil.github.io/spoof-rtlo.html
• Click Download File.
• Observe the filename in the download UI — it appears as invoiceexe.pdf even though the actual extension is .exe.
  Please note that the .exe is displayed from the first second when the download starts, and in the download section.
  video

Comment 8

[Moch. Azril]

Hey Team, thank you for the verification. Now, are we eligible for CVE?

Comment 9

[Tom Ritter [:tjr]]

(In reply to Azril from comment #8)

Hey Team, thank you for the verification. Now, are we eligible for CVE?

Yes, it may take us a little bit to complete the process.

Comment 10

[Moch. Azril]

(In reply to Tom Ritter [:tjr] (one week until extended leave) from comment #9)

(In reply to Azril from comment #8)

Hey Team, thank you for the verification. Now, are we eligible for CVE?

Yes, it may take us a little bit to complete the process.

How long will it take to complete?

Comment 11

[mreagan]

Attachment: advisory.txt

Comment 12

[Tom Ritter [:tjr]]

https://www.mozilla.org/en-US/security/advisories/mfsa2025-97/

Comment 13

[Tom Ritter [:tjr]]

This is an automated duplicate detection tool. It suggests that Bug 2010874 should be marked as a duplicate of this bug. The reasoning is: Both report RTLO/RTL characters in download filenames reordering the displayed name in the iOS download UI to hide the real executable extension (invoice[U+202E]fdp.exe shown as invoiceexe.pdf); bug 1984683 is earlier and verified.