Firefox for Android CVE-2026-84117

User interaction is required (UI:R in the CVSS vector) - the victim must visit attacker-controlled content and perform at least one interaction within Firefox for Android. The attack is delivered over the network (AV:N) with low complexity (AC:L), meaning no brute-force or race condition is involved once the user loads the page. No authentication or special privilege is required of the attacker (PR:N). The vulnerability is specific to the Android platform build of Firefox; desktop or iOS Firefox users are not within the stated scope. No additional non-default configuration is documented as a prerequisite. Exploitation is limited by the requirement for user interaction, the Android-platform-only scope, and the current absence of public exploit tooling.

The CVSS 3.1 base score of 8.8 (High) is driven by network delivery (AV:N), low complexity (AC:L), no required privileges (PR:N), and total C/I/A impact - offset only by required user interaction (UI:R). SSVC corroborates the severity with a 'total' technical impact rating but notes exploitation status as 'none' and automatable as 'no', meaning mass exploitation is not currently occurring and scripted, hands-off attack chains are not trivial. No EPSS data was provided in the source intelligence, which is a gap for quantitative risk comparison. No KEV listing and no confirmed POC further reduce the immediate operational risk despite the high theoretical score. The overall picture is a high-severity vulnerability that is not currently being exploited at scale, making prompt patching the correct response rather than emergency incident response.

An attacker crafts a malicious web page designed to abuse the improper access control flaw in Firefox for Android's privilege enforcement logic. When an Android device user browses to the page and performs an interaction - such as clicking a link or triggering a script event - the browser's access control boundary is bypassed, allowing the attacker's content to escalate to a higher privilege context and achieve full read/write/execute impact within that context. No public proof-of-concept code has been identified at time of analysis.