CVE-2026-100823

Analyzed Analyzed - Analysis Complete

Firefox for Android Downloads Component Spoofing

Publication date: 2026-09-29

Last updated on: 2026-10-05

Assigner: Mozilla Corporation

Description

Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 157.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-10-05

Generated

2026-10-19

AI Q&A

2026-09-29

EPSS Evaluated

2026-10-18

NVD

CVE-2026-100823

EUVD

EUVD-2026-88802

Affected Vendors & Products

Vendor	Product	Version / Range
mozilla	firefox_mobile	to 157.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-451	The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.

Attack-Flow Graph

Executive Summary

This vulnerability is a spoofing issue in Firefox for Android's Downloads component. It occurs when long filenames are truncated in download completion notifications, hiding the file extension. This makes it difficult for users to identify the actual file type from the notification.

Detection Guidance

This vulnerability is specific to Firefox for Android and involves filename truncation in download notifications. To detect it, check if your Firefox for Android version is below 157. If you see download notifications where long filenames obscure file extensions, the vulnerability may be present.

Impact Analysis

Users may be tricked into opening malicious files if they cannot see the file extension in notifications. For example, a file named 'document.pdf.exe' could appear as 'document.pdf' if truncated, leading to unintended execution of harmful software.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. The issue involves misleading filename extensions in download notifications, which could potentially lead to users downloading malicious files unknowingly. However, there is no evidence that this vulnerability results in unauthorized data access, disclosure, or other compliance violations.

Mitigation Strategies

Update Firefox for Android to version 157 or later to apply the fix. Avoid downloading files with very long names until the update is applied. Check notification behavior for truncated filenames as a potential indicator.

Hi! I’m here to help you understand CVE-2026-100823. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70