Description
Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been be bypassed (distinct from CVE-2025-0245). This vulnerability was fixed in Firefox 136.
Published: 2025-03-04
Score: 9.1 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Authentication bypass leading to unauthorized access
Action: Immediate Patch
AI Analysis

Impact

In Firefox Focus for Android, a flaw enables bypassing a user opt‑in setting that requires authentication before the app can be used. This removes the intended security barrier, allowing an attacker to access sensitive functionality or data without permission. The weakness is classified as an access control issue (CWE‑284) combined with a missing authentication (CWE‑306).

Affected Systems

Mozilla Firefox Focus for Android on all versions prior to 136 are impacted. Versions 136 and later contain the fix. Any device running an earlier build remains vulnerable.

Risk and Exploitability

The CVSS score of 9.1 marks the vulnerability as severe, while the EPSS score of less than 1% indicates a very low likelihood of exploitation in the short term. The issue is not currently listed in the CISA KEV catalog. Exploitation would require local device access or the ability to load malicious content into the Focus app, a plausible scenario on compromised Android devices. Despite the low exploitation probability, the high severity warrants prompt remediation.

Generated by OpenCVE AI on April 20, 2026 at 18:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Firefox Focus to version 136 or later on all Android devices.
  • If upgrade cannot be performed immediately, uninstall the vulnerable Focus app or disable any authentication‑requiring setting until a patched version is available.
  • Apply device‑wide security controls such as app whitelisting and monitor logs for unauthorized use of Focus features.

Generated by OpenCVE AI on April 20, 2026 at 18:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-7443 Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been be bypassed (distinct from CVE-2025-0245). This vulnerability affects Firefox < 136.
History

Mon, 13 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Description Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been be bypassed (distinct from CVE-2025-0245). This vulnerability affects Firefox < 136. Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been be bypassed (distinct from CVE-2025-0245). This vulnerability was fixed in Firefox 136.
Title firefox: Lock screen setting bypass in Firefox Focus for Android Lock screen setting bypass in Firefox Focus for Android

Fri, 28 Mar 2025 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
CPEs cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
Vendors & Products Mozilla
Mozilla firefox

Wed, 05 Mar 2025 03:00:00 +0000

Type Values Removed Values Added
Title firefox: Lock screen setting bypass in Firefox Focus for Android
Weaknesses CWE-306
References
Metrics threat_severity

None

 threat_severity

Moderate

Tue, 04 Mar 2025 16:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 04 Mar 2025 13:45:00 +0000

Type Values Removed Values Added
Description Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been be bypassed (distinct from CVE-2025-0245). This vulnerability affects Firefox < 136.
References

Subscriptions

Mozilla Firefox
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-04-13T14:30:25.557Z

Reserved: 2025-03-04T12:29:48.176Z

Link: CVE-2025-1941

cve-icon Vulnrichment

Updated: 2025-03-04T15:48:24.179Z

cve-icon NVD

Status : Modified

Published: 2025-03-04T14:15:39.063

Modified: 2026-04-13T15:16:53.777

Link: CVE-2025-1941

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-03-04T13:31:25Z

Links: CVE-2025-1941 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-20T18:30:13Z

Weaknesses