Android applications can use Custom Tabs to display web content and support transition animations that allow attackers to mask the true clickable target. The weakness, classified as CWE-1021 and CWE-359, enables malicious code to mislead a user into granting permissions they did not intend to provide. The impact is that a user might unwittingly consent to sensitive permissions, exposing personal data and potentially allowing further malicious activity.

This issue affects Firefox applications on Android that employ Custom Tabs, specifically any release prior to Firefox 136. Mobile apps relying on old Firefox Custom Tab integration are vulnerable.

The CVSS score of 3.9 reflects a low severity, and the EPSS value of <1 % indicates a very small probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is an Android application that loads malicious content in a Custom Tab and uses transition animations to hide the real click target, thereby tricking the user into granting permissions. Given the low severity and exploitation likelihood, the overall risk remains modest but still warrants timely remediation.