Firefox for Android CVE-2026-16397

Exploitation requires the victim to be running Firefox for Android prior to version 153 and to actively visit an attacker-controlled web page that serves crafted UI overlay content. The CVSS vector confirms the attack is network-delivered (AV:N) and requires no attacker privileges (PR:N), but mandates active user interaction (UI:R) - the victim must click or otherwise interact with a hijacked UI element. Exploitation is limited to the Android platform's WebExtensions component context; desktop Firefox is not indicated as affected. No non-default configuration or special feature enablement is described as a prerequisite, suggesting the vulnerability exists in the default Firefox for Android installation. The primary limiting factor is the UI:R requirement, which prevents fully automated exploitation and reduces mass-targeting potential.

The CVSS 6.5 Medium score (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) accurately captures the primary risk signals: the attack is network-delivered and low-complexity, but mandates active user interaction (UI:R), which limits opportunistic mass exploitation. The unchanged scope (S:U) confirms impact is bounded to the vulnerable browser instance rather than propagating to underlying OS or adjacent systems. Integrity impact is rated high (I:H) because the attacker can cause the victim to perform unintended authenticated actions within the browser's context. EPSS data was not provided in the input, so quantitative exploitation probability cannot be assessed. The absence of both a KEV listing and known POC code supports a moderate real-world priority rating - this is not a zero-interaction, remotely-exploitable flaw. The 'XSS' tag in the metadata may suggest a broader attack surface or chaining potential, but this is not confirmed by the description or CVSS vector.

An attacker hosts a malicious web page that renders invisible or transparent UI frames over legitimate-looking interface elements targeting Firefox for Android's WebExtensions rendering context. When a victim on an unpatched Firefox for Android visits the page and clicks what appears to be a benign button or link, the interaction is captured by the attacker's overlay layer, causing the browser to execute an unintended high-integrity action - such as granting permissions or triggering extension behaviors - on the victim's behalf. No public exploit code has been identified at time of analysis.