Firefox for Android EUVD-2026-88802

Requires the victim to be running Firefox for Android (the desktop builds are not implicated) and to actively visit an attacker-controlled page and interact with a download prompt (UI:R). The attack targets the Downloads component's presentation of download metadata; no authentication or special privileges are needed (PR:N), but the mandatory user interaction and the mobile-only, pre-157 version constraint materially limit realistic exploitation. Patched in Firefox 157, so only unpatched Android installations are exposed.

This is a low-to-moderate priority spoofing defect, not an urgent fix. Multiple signals converge on low real-world risk: CVSS 3.1 base is 5.4 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L, meaning no privileges are required but victim interaction (UI:R) is mandatory and impact is limited to low confidentiality and low availability with no integrity loss. CISA's SSVC decision scores it Exploitation: none, Automatable: no, Technical Impact: partial - i.e., no observed exploitation, cannot be scripted for mass abuse, and only partial technical impact. There is no EPSS score, no CISA KEV listing, and no public proof-of-concept provided, so this is 'no public exploit identified at time of analysis.' The only apparent conflict is tagging/labeling rather than scoring: the 'Information Disclosure' tag and 'Google' vendor tag do not fit a Mozilla Firefox-for-Android spoofing bug (see data_quality_flags). The CVSS C:L rating is consistent with a UI spoofing deception rather than a direct data breach. Net: a genuine but low-severity client-side issue best handled by routine browser updates, not emergency patching.

An attacker hosts a malicious web page that, when visited in Firefox for Android, manipulates how the Downloads component presents a download - spoofing the apparent origin, filename, or security context so the user is misled about what they are saving or where it came from. Because UI:R is required, the victim must actively interact (visit the page and engage with the download prompt) for the deception to succeed. No public exploit code or active exploitation has been reported.