CVE-2025-1940

Android Intent confirmation prompt tapjacking using Select options

Published Mar 4, 2025 CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Description

A select option could partially obscure the confirmation prompt shown before launching external apps. This could be used to trick a user in to launching an external app unexpectedly.
*This issue only affects Android versions of Firefox.*. This vulnerability was fixed in Firefox 136.

Analysis

Technical impact

A select element can partially hide the confirmation dialog that appears before an Android app launches an external intent, misleading users into believing they are consenting. The result is an unexpected launch of a potentially malicious or unwanted external application. This is a usability‑based exploitation, mapped to the UI deception weakness.

Affected Systems

Mozilla Firefox on Android platforms, before version 136. Users running older Android versions of Firefox are vulnerable.

Risk and Exploitability

The CVSS score of 7.1 indicates moderate impact with possible business damage and privacy concerns. EPSS is below 1 %, suggesting exploitation is rare at the moment. The vulnerability is not listed in CISA KEV and therefore is not known to be actively exploited. The attack vector is inferred to rely on user interaction; an attacker would need to trick a user into selecting an option that overlays the confirmation prompt, which requires social engineering.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Mozilla

Firefox

affected

Version	Status	Constraints
`136`	unaffected	≤ *

Configuration 1 [-]

cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to Firefox Android version 136 or later, which removes the UI deception issue.
Apply any available Android OS security updates that may patch related intent handling vulnerabilities.
Disable any third‑party applications or overlays that alter the Android UI, as these can amplify the impact of UI‑based attacks.

Generated by OpenCVE AI on April 20, 2026 at 18:23 UTC.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-7442	A select option could partially obscure the confirmation prompt shown before launching external apps. This could be used to trick a user in to launching an external app unexpectedly. This issue only affects Android versions of Firefox. This vulnerability affects Firefox < 136.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.249% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://bugzilla.mozilla.org/show_bug.cgi?id=1908488
https://nvd.nist.gov/vuln/detail/CVE-2025-1940
https://www.cve.org/CVERecord?id=CVE-2025-1940
https://www.mozilla.org/security/advisories/mfsa2025-14/

History

Apr 13, 2026 3:00 PM Description updated. Title updated View changes

Type	Values Removed	Values Added
Description	A select option could partially obscure the confirmation prompt shown before launching external apps. This could be used to trick a user in to launching an external app unexpectedly. This issue only affects Android versions of Firefox. This vulnerability affects Firefox < 136.	A select option could partially obscure the confirmation prompt shown before launching external apps. This could be used to trick a user in to launching an external app unexpectedly. This issue only affects Android versions of Firefox.. This vulnerability was fixed in Firefox 136.
Title	firefox: Android Intent confirmation prompt tapjacking using Select options	Android Intent confirmation prompt tapjacking using Select options

Apr 3, 2025 2:00 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Mozilla Mozilla firefox
CPEs		cpe:2.3:a:mozilla:firefox::::::::
Vendors & Products		Mozilla Mozilla firefox

Mar 5, 2025 3:00 AM Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Title		firefox: Android Intent confirmation prompt tapjacking using Select options
Weaknesses		CWE-451
References		https://nvd.nist.gov/vuln/detail/CVE-2025-1940 https://www.cve.org/CVERecord?id=CVE-2025-1940
Metrics	threat_severity `None`	threat_severity `Moderate`

Mar 4, 2025 4:15 PM Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-1021
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mar 4, 2025 1:45 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description		A select option could partially obscure the confirmation prompt shown before launching external apps. This could be used to trick a user in to launching an external app unexpectedly. This issue only affects Android versions of Firefox. This vulnerability affects Firefox < 136.
References		https://bugzilla.mozilla.org/show_bug.cgi?id=1908488 https://www.mozilla.org/security/advisories/mfsa2025-14/