Firefox for Android allowed a sandboxed iframe that lacked the allow-downloads attribute to trigger file downloads. This flaw, identified as CWE‑732, permits untrusted web content to initiate arbitrary downloads without the user's explicit consent, potentially exposing users to malicious files, phishing, or malware. The impact is the compromise of user data integrity and confidentiality through unwanted downloads and could facilitate further infection or data exfiltration.

Mozilla Firefox for Android is affected. Versions prior to 141 contain the vulnerability; the issue was fixed in the 141 release. Users running earlier builds are at risk.

The CVSS score of 9.8 classifies the vulnerability as critical. However, the EPSS score of less than 1% indicates a low probability of exploitation at the time of analysis. It is not listed in CISA's KEV catalog. The likely attack vector is a malicious or compromised web page that embeds a sandboxed iframe without allow-downloads, drawing the user to download malicious payloads. The condition for exploitation requires the victim to view such content in Firefox for Android.