Firefox for Android CVE-2026-74980

Exploitation requires the victim to be running Firefox for Android at a version prior to 154 and to navigate to an attacker-controlled webpage designed to exploit the Downloads component via UI redress. The CVSS vector confirms user interaction is mandatory (UI:R) - the victim must tap or interact with the overlaid interface, meaning passive page-load alone is insufficient. No attacker authentication is required (PR:N), and no special non-default browser configuration is needed. Exploitation is limited by: (1) Android platform scope - desktop Firefox is not indicated as affected; (2) the requirement for the victim to visit an attacker-controlled page and interact with it; and (3) impact is bounded to integrity (I:H) with no confidentiality or availability consequence, reducing attacker incentive relative to RCE-class flaws.

The CVSS 6.5 Medium score (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) reflects a network-reachable, low-complexity attack requiring only user interaction, with high integrity impact but no confidentiality or availability consequence. The high integrity impact likely models the ability to coerce unintended download actions from the victim. The mandatory user interaction (UI:R) is the primary limiting factor and precludes fully automated exploitation. EPSS at 0.14% (4th percentile) is notably low even for a Medium-severity flaw, suggesting no observed mass exploitation. There is no CISA KEV listing and no POC has been identified, aligning with the low EPSS signal. The absence of a scope change (S:U) confirms impact is contained to the victim's browser session. Overall, this is a realistic but low-urgency risk: real-world harm requires a targeted social engineering step and is bounded to Android Firefox users on unpatched versions - a straightforward patch remediation case with no evidence of active campaigns.

An attacker hosts a malicious web page that renders a transparent overlay or iframe targeting the Firefox for Android Downloads component, positioning deceptive UI elements to align with download-confirmation controls. A victim browsing to this page on unpatched Firefox for Android is tricked into tapping what appears to be innocuous content, unknowingly triggering an unintended file download or download-related action. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) means any attacker capable of hosting a web page and luring a victim could attempt this.