A crafted URL using a blob: URI can conceal the true origin of a web page, allowing a malicious actor to present a page that appears to come from a legitimate site while actually originating elsewhere; the vulnerability could be exploited in a phishing or spoofing scenario, potentially misleading users despite no direct code execution or privilege escalation being stated.

Mozilla Firefox for Android operating systems. All Firefox releases prior to 141 on Android devices are affected, as the issue was resolved in Firefox 141.

The CVSS score of 4.3 reflects a low-moderate risk profile, and the EPSS score of less than 1% indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require a user to open a crafted link or be tricked into interacting with a blob: URI, which suggests the attack vector is likely user‑initiated activity such as clicking a malicious link or visiting a tampered web page.