Firefox versions older than 144 displayed the password edit screen in the Android card carousel, exposing user-entered passwords to page thumbnails. The vulnerability allows the password characters to become visible when a user switches between apps, potentially leaking sensitive authentication information. The flaw is a classic data disclosure issue identified as CWE‑200.

The problem affects Mozilla Firefox installations on Android devices running Firefox prior to version 144. All Android operating systems are listed as affected, reflecting the card carousel feature native to Android that renders Firefox pages as cards for app switching. No other vendors or product lines are implicated.

The CVSS score of 9.1 categorizes this as a high‑severity vulnerability, reflecting the privacy compromise risk it poses. The EPSS figure of less than 1 % indicates a very low likelihood of exploitation in the wild at the time of assessment, yet the lack of mitigations beyond a software update means that every user of the affected Firefox builds remains at risk. The vulnerability is not listed in the CISA KEV catalog, but its impact justifies prompt remediation.