A select element can partially hide the confirmation dialog that appears before an Android app launches an external intent, misleading users into believing they are consenting. The result is an unexpected launch of a potentially malicious or unwanted external application. This is a usability‑based exploitation, mapped to the UI deception weakness.

Mozilla Firefox on Android platforms, before version 136. Users running older Android versions of Firefox are vulnerable.

The CVSS score of 7.1 indicates moderate impact with possible business damage and privacy concerns. EPSS is below 1 %, suggesting exploitation is rare at the moment. The vulnerability is not listed in CISA KEV and therefore is not known to be actively exploited. The attack vector is inferred to rely on user interaction; an attacker would need to trick a user into selecting an option that overlays the confirmation prompt, which requires social engineering.