Security readout for executives and security teams
Plain-English summary
Firefox for iOS before 115 could show a permission prompt from a background tab over the site the user was viewing. A user might approve a request believing it belongs to the visible site. Public sources do not provide severity scoring or confirmed abuse.
Executive priority
Prioritize as a mobile hygiene issue unless older Firefox for iOS is common in the environment. No confirmed exploitation or severity score is provided, but the user-trust impact warrants update enforcement.
Technical view
This is a UI permission-confusion issue in Firefox for iOS < 115. A permission request initiated by a background tab could be overlaid on the foreground tab. The bundle does not identify specific permissions, prerequisites, CVSS scoring, CWE mapping, or detailed exploitability.
Likely exposure
Exposure is limited to users running Firefox for iOS versions earlier than 115, including unmanaged BYOD devices and managed mobile fleets with delayed browser updates.
Exploitation context
CISA KEV status is false, and the provided sources do not report active exploitation. Treat abuse as unconfirmed, not absent.
Researcher notes
The record is sparse. Analysis should avoid assuming permission type, impact scope, or exploit reliability. The core observable is cross-tab permission prompt overlay behavior affecting Firefox for iOS < 115.
Mitigation direction
- Update Firefox for iOS to version 115 or later.
- Use MDM or app-store controls to enforce current Firefox for iOS versions.
- Check Mozilla advisory guidance for any additional vendor-specific recommendations.
- Communicate the permission-prompt risk to mobile support teams.
Validation and detection
- Inventory Firefox for iOS versions across managed devices.
- Confirm no managed device remains below version 115.
- Review BYOD guidance for minimum supported mobile browser versions.
- Track Mozilla advisory MFSA2023-25 in vulnerability management records.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2023-37455 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://bugzilla.mozilla.org/show_bug.cgi?id=1786934CVE reference
- https://www.mozilla.org/security/advisories/mfsa2023-25/CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.