A spoofing flaw exists in the WebAuthn component of Firefox for Android. The issue permits an attacker to forge authentication credentials, allowing them to impersonate legitimate users or bypass two‑factor checks. This can compromise user privacy, lead to unauthorized access, and undermine the integrity of authentication flows on affected devices.

Mozilla Firefox and Mozilla Thunderbird are affected. The flaw is present in all releases prior to Firefox 143 and Thunderbird 143 and is fixed in those versions and later.

The vulnerability carries a CVSS score of 6.5, indicating a medium‑to‑high severity. The EPSS score is below 1 %, suggesting a very low probability of exploitation in the wild, and the flaw is not listed in the CISA KEV catalogue. The attack vector is likely client‑side, requiring compromise of an Android device or manipulation of the WebAuthn flow on the device; no active network exploitation is described in the advisory.