Firefox for Android CVE-2026-74951

The victim must be using Firefox for Android (any version prior to 154) and must actively visit and interact with an attacker-controlled webpage - user interaction (UI:R) is a hard prerequisite. No authentication is required from the attacker's side. Exploitation is limited to Firefox for Android; the Firefox desktop browser is not confirmed affected by this CVE. The attack is constrained to the scope of the browser's browsing context (Scope:Unchanged), meaning the attacker cannot directly escape the browser sandbox or pivot to OS-level compromise via this vulnerability alone. Successful exploitation depends on the attacker's ability to socially engineer the victim into visiting the malicious page and performing a tap or click action.

The NVD CVSS 3.1 score of 6.5 Medium reflects a realistic middle-ground threat: network-accessible (AV:N), low complexity (AC:L), no required privileges (PR:N), but requiring user interaction (UI:R), with scope unchanged and only integrity impacted (I:H, C:N, A:N). In practice, clickjacking on a mobile browser is a credible social engineering vehicle - attackers can craft convincing lure pages that prompt taps in predictable locations. However, the absence of a KEV listing and the lack of any identified public exploit or POC significantly reduce urgency. No EPSS data was provided, limiting probabilistic exploitation assessment. The tags include 'XSS', which appears to be a mislabeling - CWE-1021 is definitively clickjacking, not cross-site scripting. The Scope:Unchanged metric means a successful attack does not pivot to other system components, bounding the blast radius. Overall, this is a genuine medium-priority issue for organizations with managed Android fleets - warranting prompt patching but not emergency response.

An attacker registers a convincing domain and hosts a page that positions a transparent iframe over a Firefox for Android UI element - such as a permission grant button or a payment confirmation dialog. The victim is lured to the attacker's page via phishing link or malicious ad, and their tap on an apparently benign element is silently captured by the hidden layer, triggering an unintended high-impact action. No public exploit or POC is known at time of analysis, but the attack pattern requires only basic HTML and CSS knowledge to construct.