The flaw allows a malicious web page to trigger a redirect to an invalid protocol scheme. Firefox for Android then displays the attacker‑supplied URL in the address bar, creating a visual spoof that can mislead users into believing they are on a trusted site while unknowingly interacting with malicious content. The weakness lies in improper validation of the scheme component, as identified by CWE‑451 and CWE‑601, and can jeopardize confidentiality and integrity by enabling deceptive interactions.

Any installation of Mozilla Firefox running on Android devices that is older than version 134 is susceptible. The issue does not affect Firefox on other operating systems or Firefox 134 and later, which include the fix that validates the scheme before updating the UI.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of 7% reflects a modest likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploitation has been observed. Attackers would need to lure a user to click a crafted link or visit a malicious site; no elevated privileges are required. Because the flaw is limited to Android, the attack surface is confined to mobile users running older Firefox versions.