CVE-2026-74951

Analyzed Analyzed - Analysis Complete

Clickjacking Vulnerability in Firefox for Android

Publication date: 2026-08-18

Last updated on: 2026-08-19

Assigner: Mozilla Corporation

Description

Clickjacking issue in Firefox for Android. This vulnerability was fixed in Firefox 154.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-19

Generated

2026-10-18

AI Q&A

2026-08-18

EPSS Evaluated

2026-10-16

NVD

CVE-2026-74951

EUVD

EUVD-2026-60679

Affected Vendors & Products

Vendor	Product	Version / Range
mozilla	firefox_mobile	to 154.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1021	The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain.

Attack-Flow Graph

Executive Summary

This is a clickjacking vulnerability in Firefox for Android. Clickjacking occurs when an attacker tricks a user into clicking on a malicious link or button that is hidden or disguised, potentially allowing unauthorized actions to be performed on a website the user is logged into.

Detection Guidance

This vulnerability is specific to Firefox for Android and was fixed in Firefox 154. Detection would involve checking the installed version of Firefox on Android devices. If the version is below 154, the system is vulnerable.

Impact Analysis

An attacker could exploit this to perform actions on your behalf without your knowledge, such as changing settings, making purchases, or accessing sensitive data, if you are logged into a vulnerable service while using Firefox for Android.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or other standards as it is a clickjacking issue in Firefox for Android. Clickjacking primarily impacts user interface interactions and does not inherently involve data breaches or unauthorized access to sensitive information.

Mitigation Strategies

Update Firefox for Android to version 154 or later to address the clickjacking vulnerability.

Hi! I’m here to help you understand CVE-2026-74951. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70