Firefox · Core
CVE-2025-10530
Logic Error in Core
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifmobile/android/geckoview/src/main/java/org/mozilla/gecko/util/IntentUtils.java |
modified |
Files Changed
mobile/android/geckoview/src/main/java/org/mozilla/gecko/util/IntentUtils.java
Patch
diff --git a/mobile/android/geckoview/src/main/java/org/mozilla/gecko/util/IntentUtils.java b/mobile/android/geckoview/src/main/java/org/mozilla/gecko/util/IntentUtils.java
index 463f75c777b..b1bb4687ef4 100644
--- a/mobile/android/geckoview/src/main/java/org/mozilla/gecko/util/IntentUtils.java
+++ b/mobile/android/geckoview/src/main/java/org/mozilla/gecko/util/IntentUtils.java
@@ -89,7 +89,7 @@ public class IntentUtils {
}
if (("intent".equals(scheme) || "android-app".equals(scheme))) {
- // Bug 1356893 - Rject intents with file data schemes.
+ // Bug 1356893 - Reject intents with file data schemes.
return getSafeIntent(aUri) != null;
}
@@ -115,8 +115,11 @@ public class IntentUtils {
}
final Uri data = intent.getData();
- if (data != null && "file".equals(normalizeUriScheme(data).getScheme())) {
- return null;
+ if (data != null) {
+ final String scheme = normalizeUriScheme(data).getScheme();
+ if ("file".equals(scheme) || "fido".equals(scheme)) {
+ return null;
+ }
}
// Only open applications which can accept arbitrary data from a browser.
Loading diff…
References
On This Page