Firefox for Android CVE-2026-74975

Exploitation requires the victim to be running Firefox for Android on a version prior to 154 and to visit a malicious or attacker-controlled web page that triggers a download interaction. The CVSS UI:R metric confirms user interaction is mandatory - the user must engage with the download flow (e.g., tapping a download link or observing the Downloads component UI). The attack is limited to the Android platform's Downloads component; desktop Firefox is not in scope. No authentication is required on the attacker's side (PR:N), but the victim must be an active Firefox for Android user browsing to attacker-controlled content. Non-Android Firefox deployments are not affected by this specific issue.

The CVSS 3.1 base score of 5.4 (Medium) reflects a moderate, realistic risk posture. The vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L indicates the attack is network-reachable and low-complexity, but requires user interaction - consistent with a user actively initiating or viewing a download from a malicious page. The I:N metric is notable: despite being a spoofing vulnerability (which typically implies some integrity or trust violation), NVD assesses no direct integrity impact, suggesting the manipulation is purely presentational. SSVC confirms exploitation status as none and the attack is not automatable, meaningfully reducing real-world urgency. EPSS data was not provided, so exploitation probability cannot be quantified. The 'Google' tag may indicate this was reported through Google's bounty coordination with Mozilla but does not imply active exploitation. Overall this is a genuine but lower-priority vulnerability appropriate for routine patch cycles, not emergency response.

An attacker hosts a malicious web page that initiates a download and crafts the response or associated UI elements to misrepresent the file's name, type, or origin within the Firefox for Android Downloads panel. A user who taps the download notification or opens the Downloads view sees a spoofed representation - for example, a malicious APK presented as a PDF - and may take action based on that false context. No public proof-of-concept exists at time of analysis.