Description

Privilege escalation in Firefox for Android. This vulnerability was fixed in Firefox 155.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-01T13:20:05.487Z",
  "pubdate": "2026-09-01T13:20:05.487Z",
  "executiveSummary": "A privilege escalation vulnerability exists in Firefox for Android, specifically addressed in version 155. This flaw allows a locally present or contextually positioned attacker to bypass intended security boundaries within the browser's Android application environment.\nThe vulnerability pertains to an improper privilege management or component isolation failure, potentially permitting an attacker to execute code or access sensitive resources with elevated permissions beyond the standard sandbox constraints of the mobile application.\nImpact includes the potential for unauthorized data access, the modification of application settings, or the manipulation of the application's runtime environment. Successful exploitation requires specific conditions within the Android operating system's Inter-Process Communication (IPC) or intent-handling mechanisms.\nThe risk is categorized as high due to the potential for full application compromise. Attackers do not necessarily require remote network access, as the exploit may be triggered via local malicious apps or web-based content that interacts with the browser's vulnerable interfaces.",
  "technicalDetails": "The vulnerability resides within the internal permission handling or IPC architectural components of Firefox for Android prior to version 155. It involves an insufficient validation of incoming intents or cross-component communication requests directed at the browser's internal activities or service handlers.\nThe root cause is likely an insecure implementation of an exported Android component—such as an Activity, Service, or Broadcast Receiver—that fails to verify the calling application's identity or the integrity of the data passed through the intent. By sending a crafted intent to these exported components, an attacker can trigger unauthorized functionality or influence the browser's execution state.\nThe exploitation flow typically begins with an adversary identifying an exported entry point in the AndroidManifest.xml of the Firefox application that lacks proper 'android:permission' attributes or signature-level protection. The attacker crafts a malicious Android Intent, populated with specific extras or data fields designed to coerce the browser's internal logic into performing an action that the standard browser sandbox would normally prohibit.\nFor instance, if the browser exposes a component intended for internal configuration or session management, the malicious intent might bypass checks that verify the source of the request. This permits the attacker to interact with the browser's profile data, manipulate session cookies, or potentially execute arbitrary JavaScript within a context that possesses broader browser privileges.\nThe attack is context-dependent, relying on the Android security model's handling of inter-application communication. By exploiting these weaknesses, the attacker can escalate from a standard mobile application context to the privilege level afforded to the Firefox browser process. This allows for post-exploitation actions including, but not limited to, the extraction of stored credentials, history exfiltration, or the injection of malicious content into legitimately visited web pages.\nThe vulnerability is limited to versions of Firefox for Android preceding version 155. Exploitation does not typically require remote network access if the triggering mechanism is initiated locally via a side-loaded or malicious application already installed on the Android device. This effectively bypasses standard web-origin security controls by operating directly against the browser's native Android integration layer."
}