Information Disclosure in Firefox for Android WebExtensions

Executive Summary

CVE-2026-84127 is an information disclosure vulnerability in Firefox for Android's WebExtensions component. It caused tabs opened by extensions to incorrectly appear as private browsing tabs in the UI, even though they were not actually private. This happened because the private browsing flag was not properly passed to GeckoView, leading to potential unintended data exposure like cookies or cache.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is specific to Firefox for Android and involves incorrect display of private browsing tabs opened by extensions. Detection requires checking Firefox for Android version and verifying if tabs opened by extensions appear as private but share session data. No direct network commands are applicable. Check Firefox version with 'about:support' in the browser or system app settings.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow extensions to open tabs that appear private but actually share session data with regular tabs. This might expose sensitive information like cookies or cached data to unauthorized extensions, potentially leading to privacy breaches or data leaks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unintended data exposure, such as cookies or cache, when extensions opened tabs in private browsing mode without proper access permissions. This may violate data protection principles under GDPR and HIPAA by exposing sensitive user data.

Useful 0 Not Useful 0

Mitigation Strategies

Update Firefox for Android to version 155 or later immediately. Disable or remove untrusted extensions until updated. Avoid using extensions to open private tabs until confirmed patched. Monitor for unusual session data sharing between tabs.

Useful 0 Not Useful 0