This vulnerability allows an attacker to cause Firefox for Android to present misleading information about downloaded content, effectively spoofing the source or nature of a file. The primary impact is that users may trust a malicious download and then unknowingly execute or trust the data, potentially leading to further compromise. The weakness centers on the Downloads component and is a classic spoofing flaw that undermines user confidence and can be exploited to facilitate downstream attacks.

Mozilla Firefox for Android, versions prior to 159, are affected. The issue is fixed in Firefox 159 and later releases.

No CVSS score is published for this advisory, and the EPSS score is not available, indicating limited publicly known exploitation data. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector requires a user to initiate a download via a malicious source, so the risk is considered moderate for users who are careless with downloads. At a minimum, an unauthenticated attacker could perform the attack by hosting deceptive URLs and enticing users; these conditions are inferred from the described issue and are not explicitly documented in the advisory.