Firefox for Android normally asks for user confirmation before opening a link in an external application. The discovered flaw allows an attacker to trick the browser into bypassing this confirmation step, thereby permitting the execution of or interaction with the chosen external app without the user’s knowledge. This can lead to exploitation of vulnerabilities or privacy leaks in the external application, and is classified as a CWE-285 weakness involving unauthorized authorization control.

This issue affects Mozilla’s Firefox for Android releases prior to version 140. All Android users running earlier builds are vulnerable. No other Firefox desktop or mobile variants are impacted.

The CVSS score of 6.5 indicates moderate severity, with an EPSS score lower than 1% suggesting a low likelihood of widespread exploitation. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to involve an attacker embedding a specially crafted link or URI scheme that the browser would normally prompt for, but now bypasses, thereby directing the device to open an external app or trigger a vulnerable component without user consent.