EUVD-2026-52667
GHSA-v5x7-vhwf-5v44
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network-based exploitation with no privilege requirement but mandatory user interaction; impact is confidentiality-only with no integrity or availability effect.
Primary rating from Vendor (mozilla).
CVSS VectorVendor: mozilla
Lifecycle Timeline
3DescriptionCVE.org
Information disclosure in Firefox for Android and Firefox Focus for Android. This vulnerability was fixed in Firefox 153.0.3.
AnalysisAI
Information disclosure in Firefox for Android and Firefox Focus for Android exposes sensitive user data to network-based attackers who can lure a victim into interacting with a crafted web resource. The vulnerability, tracked under CWE-200 and assigned a CVSS score of 6.5 with high confidentiality impact, is limited to Android platform builds and does not affect desktop Firefox. Mozilla patched this in Firefox 153.0.3 per advisory mfsa2026-73; no public exploit or active exploitation has been identified at time of analysis.
Technical ContextAI
CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) covers cases where an application inadvertently reveals data to parties not authorized to receive it - typically through improper access controls, insecure data handling, or unintended side channels in rendering or network logic. The affected products are Mozilla's Android-specific browser builds: Firefox for Android (the mainstream browser) and Firefox Focus for Android (the privacy-focused variant with automatic tracking protection). Both share Android-platform-specific code paths distinct from the desktop codebase, suggesting the root cause lies in Android-specific functionality - possibly related to inter-app communication, content provider access, or Android WebView/Intent handling. The 'Google' tag on this CVE is notable and may indicate the vulnerability involves Google infrastructure, APIs, or that the issue was discovered via a Google security program, though this is not confirmed from available data.
Affected ProductsAI
Firefox for Android, all versions prior to 153.0.3, and Firefox Focus for Android (fix version for Focus not separately enumerated in available data but covered by the same advisory). The Mozilla Security Advisory mfsa2026-73 at https://www.mozilla.org/security/advisories/mfsa2026-73/ is the authoritative source for affected version ranges. No explicit CPE strings were provided in the input data. Desktop Firefox and Firefox for iOS are not referenced and are presumed unaffected.
RemediationAI
Update Firefox for Android and Firefox Focus for Android to version 153.0.3 or later, available through the Google Play Store or Mozilla's official distribution channels. The fix is documented in Mozilla Security Advisory mfsa2026-73 (https://www.mozilla.org/security/advisories/mfsa2026-73/) and the underlying bug is tracked at https://bugzilla.mozilla.org/show_bug.cgi?id=2055683 (access may be restricted). If immediate update is not possible, users should avoid clicking unknown links or visiting untrusted websites in Firefox for Android, as user interaction is required for exploitation; switching to an alternative browser temporarily is a viable workaround until patching is complete. Enterprise mobile device management (MDM) policies can be used to enforce the update or restrict browser usage on managed Android devices.
The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote
Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox b
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird befo
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remo
The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and b
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today