When a user opens a link that contains an invalid protocol scheme, Firefox for Android renders a forged address bar display, causing the user to believe they are viewing a legitimate site. The attacker can therefore present malicious content under the guise of a trusted domain, potentially leading to phishing or social‑engineering attacks. This flaw does not provide direct code execution or data exfiltration, but the deception effect can carry significant business and reputational impact.

The issue affects all versions of Mozilla Firefox for Android prior to the 134 release. Operating systems other than Android are unaffected. Any Android device running an outdated Firefox installation is vulnerable until a patched version is installed.

The CVSS score of 6.5 describes the vulnerability as moderate, and the EPSS score of less than 1% indicates that exploitation incidents are expected to be rare. It is not listed in CISA’s KEV catalog. Attackers would typically need a user to interact with a malicious link—such as clicking text in an email, message, or webpage—containing the malformed scheme. No elevated privileges or additional system compromise are required to exploit this flaw.