Firefox for Android mistakenly follows a URL supplied in a link’s query‑string parameter instead of the intended hyperlink target. This defect enables an attacker to redirect users to malicious sites by embedding a crafted parameter in a legitimate page link, thereby facilitating phishing attacks. The weakness is specifically a type of malicious open‐redirect or link‐validation flaw as identified by CWE‑601.

The vulnerability exists solely in Firefox for Android. No other Firefox releases are affected. The defect could affect any Android device running a version of Firefox older than the patched release, regardless of the underlying Android OS version.

The CVSS score of 4.3 indicates a medium impact level, and the EPSS score of less than 1% suggests a very low likelihood of current exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers would likely need to control or influence the query‑string contents of a link that a user clicks within Firefox, which could occur through malicious HTML or web content. Given the low EPSS, the risk is modest but still noteworthy for users who visit untrusted sites.