CVE-2026-74975

In Firefox and Focus for Android, techniques were discovered to obscure the fullscreen notification, which could lead to user confusion and spoofing attacks. This affects Firefox for Android and Focus for Android versions prior to 112.

Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 157.

Privilege escalation vulnerability in Firefox for Android. Fixed in Firefox 156.

Privilege escalation in Firefox for Android. Fixed in Firefox 155.

Information disclosure in Firefox for Android and Firefox Focus for Android. This vulnerability was fixed in Firefox 153.0.3.

Clickjacking vulnerability in the WebExtensions component in Firefox for Android. This issue was fixed in Firefox 153.

Vulnerability in the Privacy component in Firefox for Android. The flaw leads to information disclosure. The issue was fixed in Firefox 153.

In Firefox for Android, the address bar truncated the display of URLs from the end instead of prioritizing the origin. This vulnerability was fixed in Firefox 141.

When a link can be opened in an external application, Firefox for Android will, by default, prompt the user before doing so. An attacker could have bypassed this prompt, potentially exposing the user to security vulnerabilities or privacy leaks in external applications. This bug only affects Firefox for Android. Other versions of Firefox are unaffected. This vulnerability was fixed in Firefox 140.

Vulnerability in Firefox for Android where when a URL was provided in a link querystring parameter, the browser would follow that URL instead of the correct URL, potentially leading to phishing attacks. This bug only affects Firefox for Android and was fixed in Firefox 140.