CVE-2025-11717 is a critical severity (NVD score 9.1) information exposure flaw in Firefox for Android, fixed in Firefox 144. When you switch apps using the card carousel, the preview image could show the password edit screen. Update Firefox for Android to 144 or later. Mozilla rates it moderate.
What's affected
The record lists Mozilla Firefox on Google Android. Mozilla's advisory says that the password edit screen was not hidden in Android card view. When you switch between Android apps using the card carousel, Firefox shows a black screen as its card image when a password related screen was the last one used. Prior to Firefox 144 the password edit screen was visible instead. The record classes it under CWE-200 (Exposure of Sensitive Information).
Mozilla rates this flaw as moderate in its advisory, mfsa2025-81, announced on 14 October 2025. The NVD score of 9.1 uses a different method and is higher. Both views are useful, and the vector in the record is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.
The fixed version is Firefox 144, according to both the record and the advisory.
How to check if you're exposed
On an Android phone, open Settings, then Apps, then Firefox, and read the version at the bottom of the page. You can also open the Firefox menu, go to Settings, and choose About Firefox.
On managed fleets, use your mobile device management console to list the Firefox package and its version across devices. The package name is org.mozilla.firefox for the release channel.
Anything below 144 is in the affected range per the advisory. The exposure concerns what an onlooker or a screenshot tool sees in the app switcher, so the shared and public devices matter most.
What to do now
-
Update Firefox for Android to version 144 or later through Google Play, or through your device management tool.
-
Confirm the version on shared devices, kiosks and loaner phones, since they carry the most exposure.
-
Until updated, avoid leaving a password screen open when you switch apps or hand over a device.
-
Keep automatic app updates on for browsers.
-
Add Firefox for Android to your mobile app inventory if it is not already there.
Why it matters
This is an information exposure bug, tracked as CWE-200 (Exposure of Sensitive Information). Nothing breaks into the phone. A screen that should have been hidden in the app switcher was visible, which could show a password to anyone who glances at the device or captures the switcher.
It is a good example of how scores and vendor ratings can differ. Mozilla calls the impact moderate. The NVD score is 9.1. Read the description before you read the number: the real condition is a visible password edit screen in the card carousel, which points to someone looking at the device.
The record does not mark the CVE as exploited in the CISA Known Exploited Vulnerabilities catalog, and the advisory I fetched does not report exploitation.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why does Mozilla say moderate when NVD says critical?
They score by different methods. Mozilla judges the practical effect, a visible screen in the app switcher. NVD applies the generic scoring vector. Patch either way, since the fix is a normal update.
Which version fixes it?
Firefox 144, per the Mozilla advisory mfsa2025-81 and the record.
Sources
- CVE-2025-11717 on Safeguard Gold
- NVD record for CVE-2025-11717
- Mozilla Foundation Security Advisory 2025-81
Last reviewed: 19 October 2026.
