PatchGap
Firefox · Core

CVE-2025-4090

Info Disclosure in Core
Low CVSS 5.3 firefox Info Disclosure 🔧 Commit mapped

Overview

Low
Severity
5.3
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactlow
DescriptionA vulnerability existed in Firefox for Android where potentially sensitive library locations were logged via Logcat.
ComponentCore
Bug ClassInfo Disclosure
Tracker1929478
Fix commite6eaee6ec050 (firefox) +1/-1
CWECWE-532
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CISA KEVNot listed
CreditedSeongyun Jeong
Disclosed2025-04-29

Background

Library base path
Derived by taking libmozglue.so’s full path up to the last /; this reveals the app’s native-library install directory on the device.
Android Logcat log levels
Log.i (INFO) is retained and broadly readable from the system log; Log.d (DEBUG) is intended for development and is typically stripped/not emitted in release builds, so DEBUG output is far less exposed.
CWE-532 (information exposure through log files)
Sensitive values written to logs can be read by other apps or tooling that can access Logcat.

Root Cause Analysis

GeckoLoader computed the native-library base directory and logged it at INFO level: Log.i(LOGTAG, "Library base=" + base);. On Android, INFO-level messages are emitted in shipping builds and can be collected from Logcat, so the device-specific path to Firefox for Android’s native libraries was disclosed to any party able to read the system log. That location can be security-sensitive (it narrows ASLR/layout reconnaissance and reveals install details). The fix simply lowers the log level: Log.i(...) becomes Log.d(...), so the library base path is only produced at DEBUG level and is not exposed in normal release logging.

The change is a one-line log-level downgrade; it does not alter control flow or memory handling. The advisory classes it LogicError/CWE-532, and the diff substantiates exactly that — a sensitive value was logged at too high a verbosity level, and the fix reduces its exposure.

Key insight
A sensitive install path was written to Android Logcat at INFO level, readable in release builds; the fix demotes it to DEBUG so it no longer leaks in shipped Firefox for Android.

Attack Path

  1. Attacker Has a means to read Logcat on the victim’s Android device (e.g. a co-installed app with log-reading access on older Android, ADB access, or on-device tooling).
  2. Victim Runs Firefox for Android, which calls GeckoLoader during startup.
  3. Leak Log.i(LOGTAG, "Library base=" + base) writes the native-library base directory to the INFO log.
  4. Collection The attacker reads the log entry and learns the sensitive library path. (primitive: information disclosure of a local filesystem/install location)

Impact Assessment

Information disclosure only (C:L, no integrity/availability impact), scoped to Firefox for Android. The attacker must already be able to read the device’s system log, which on modern Android is restricted — so this is a low-severity defense-in-depth fix rather than a remotely exploitable flaw. No process memory safety is involved; the gain is reconnaissance (the library install path), not code execution.

Files Changed

  • mobile/android/geckoview/src/main/java/org/mozilla/gecko/mozglue/GeckoLoader.java

Audit Directions

  • Other INFO/WARN logs of paths or identifiers
    Grep GeckoView/Android glue for Log.i/Log.w statements that include filesystem paths, URLs, tokens, or user data, and demote or remove them.
  • Native-library and profile path logging
    Review the broader GeckoLoader/startup code for other places install or profile locations are emitted.

Patch

view commit
diff --git a/mobile/android/geckoview/src/main/java/org/mozilla/gecko/mozglue/GeckoLoader.java b/mobile/android/geckoview/src/main/java/org/mozilla/gecko/mozglue/GeckoLoader.java
index e2cbe9eccb1..03ead94beac 100644
--- a/mobile/android/geckoview/src/main/java/org/mozilla/gecko/mozglue/GeckoLoader.java
+++ b/mobile/android/geckoview/src/main/java/org/mozilla/gecko/mozglue/GeckoLoader.java
@@ -211,7 +211,7 @@ public final class GeckoLoader {
       throw new IllegalStateException("Invalid library path for libmozglue.so: " + mozglue);
     }
     final String base = mozglue.substring(0, lastSlash);
-    Log.i(LOGTAG, "Library base=" + base);
+    Log.d(LOGTAG, "Library base=" + base);
     return base;
   }
Loading diff…
On This Page