Description

Information disclosure in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 155.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-01T13:20:06.640Z",
  "pubdate": "2026-09-01T13:20:06.640Z",
  "executiveSummary": "A security vulnerability categorized as an information disclosure issue exists within the WebExtensions component of Firefox for Android.\nThe vulnerability allows unauthorized access to sensitive information by bypassing existing security restrictions enforced by the browser's extension framework.\nThis flaw impacts Firefox for Android versions prior to 155, where the WebExtensions architecture failed to properly encapsulate or restrict access to protected data.\nThe risk implication is significant as it potentially enables malicious or compromised browser extensions to exfiltrate user data or sensitive internal states that should remain isolated.\nAttackers with the capability to deploy a malicious WebExtension or exploit an existing extension's permissions could leverage this flaw to access data without explicit user authorization.\nSuccessful exploitation requires the presence of an extension capable of triggering the vulnerable API or internal component interaction, potentially leading to a breach of user privacy and sensitive application-layer data.",
  "technicalDetails": "The vulnerability resides within the WebExtensions framework of Firefox for Android, specifically concerning the interaction between privileged browser APIs and the isolated execution environments of installed extensions.\nThe root cause is an improper enforcement of permission scopes and API boundary restrictions, which allows an extension to access data or state information beyond its intended privilege level.\nIn the context of Firefox's WebExtensions, each extension is designed to operate within a sandboxed environment with clearly defined access controls. This vulnerability breaks the isolation boundary by failing to correctly validate the origin or the permission context during specific inter-process communication (IPC) or internal API calls.\nThe attack flow typically initiates when an extension invokes a specific internal browser function that is exposed via the WebExtensions API. If the internal logic fails to verify if the requesting extension has been granted the necessary permissions to access the underlying resource, the component returns the sensitive data to the extension process.\nBecause Firefox for Android utilizes a distinct architecture for its mobile browsing experience, the affected WebExtensions component likely mishandles the communication bridge between the extension process and the browser's core process. The failure occurs in the mediation layer where sensitive data objects are serialized and passed to the requesting extension.\nAn attacker can exploit this by crafting a malicious extension or modifying an existing one to call the vulnerable API endpoint. Upon execution, the API, failing to perform the required access control checks, allows the attacker to retrieve information that would otherwise be restricted to the browser's internal systems or higher-privileged processes.\nPost-exploitation, the impact involves the unauthorized retrieval of sensitive data, such as local storage, browser-internal state, or potentially user-specific information handled by the browser core. The vulnerability bypasses the intended security model, rendering the sandboxing mechanisms ineffective for the affected APIs.\nThis issue was addressed by implementing rigorous validation checks on API request origin and permission inheritance within the WebExtensions framework in Firefox version 155, ensuring that all cross-process communication remains within the strict scope of the extension's declared permissions."
}