CVE-2025-11717

The password edit screen was not hidden in Android card view

State: Published
Severity: 9.1 Critical
Published: Oct 14, 2025
Updated: Apr 13, 2026
Reserved: Oct 13, 2025

Description

When switching between Android apps using the card carousel Firefox shows a black screen as its card image when a password-related screen was the last one being used. Prior to Firefox 144 the password edit screen was visible. This vulnerability was fixed in Firefox 144.

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N	CISA-ADP

Weaknesses

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected Products

Product	Versions
FirefoxMozilla	144 and laterNot affected

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1872601
https://www.mozilla.org/security/advisories/mfsa2025-81/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.