Description

Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-18T13:17:35.353Z",
  "pubdate": "2026-08-18T13:17:35.353Z",
  "executiveSummary": "A spoofing vulnerability has been identified within the Downloads component of Firefox for Android. This security flaw allows malicious actors to manipulate how download information or file representations are presented to the user interface, potentially leading to user deception regarding downloaded content. The vulnerability impacts Firefox for Android prior to version 154, where the affected component fails to adequately validate or safely render download metadata. Successful exploitation requires an attacker to induce a user into interacting with maliciously crafted content or download mechanisms within the browser environment. The primary risk implication involves user manipulation, where deceptive prompts or visual indicators might trick individuals into executing unintended actions or trusting malicious files disguised as benign downloads. No specific privileges or authentication are inherently required by the attacker beyond the capability to host or deliver malicious web content that triggers the spoofing vector within the vulnerable application context.",
  "technicalDetails": "The vulnerability resides within the Downloads component of Firefox for Android, specifically in how the application parses, processes, and displays download-related data structures to the graphical user interface. The root cause stems from insufficient sanitization and validation of external inputs or metadata associated with file download sequences, allowing discrepancy between the actual payload characteristics and the visual representation presented to the end user. Exploitation occurs when an attacker crafts a malicious web page or resource containing specially manipulated HTTP headers, MIME types, or filename parameters designed to exploit the rendering logic of the Downloads subsystem. As the browser processes the download request, the vulnerable component fails to enforce strict boundaries on string representation or origin attribution, resulting in a spoofed visual state. The step-by-step attack flow begins when the victim navigates to a compromise-controlled web resource using Firefox for Android. The malicious site initiates a download action accompanied by manipulated metadata parameters. The browser's Downloads component processes these inputs without proper validation, rendering misleading file names, extensions, or source indicators to the device screen. Consequently, the user is misled into believing the initiated download originates from a trusted source or represents a safe file type. Post-exploitation impact revolves around social engineering efficacy, as the spoofed interface facilitates the delivery of malicious payloads by reducing user suspicion. The vulnerability affects Firefox for Android versions preceding version 154 and is typically triggered over standard network exposure vectors such as HTTP or HTTPS via normal web browsing activity, operating within the standard application sandbox privileges of the browser."
}