Description
Spoofing issue in the WebAuthn component in Firefox for Android. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
Published: 2026-02-24
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Authentication Spoofing via WebAuthn
Action: Immediate Patch
AI Analysis

Impact

The CVE description states that the WebAuthn component in Firefox for Android and Thunderbird allows spoofing of credentials, permitting an attacker to impersonate legitimate users. This undermines authentication processes and can lead to unauthorized access to accounts and services.

Affected Systems

Affected products include Mozilla Firefox for Android and Mozilla Thunderbird, any version prior to 148. Both browsers incorporate the vulnerable WebAuthn implementation.

Risk and Exploitability

The CVSS score of 9.8 signals a critical severity. The EPSS score of less than 1% indicates a low probability of exploitation today. The vulnerability is not listed in the CISA KEV catalog. The CVE does not specify the precise attack vector; any discussion of how an attacker might exploit the flaw is an inference rather than a statement from the CVE data.

Generated by OpenCVE AI on April 15, 2026 at 16:04 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Mozilla Firefox for Android and Mozilla Thunderbird to version 148 or later, which contains the fix.
  • If an immediate update is not possible, disable or block WebAuthn functionality in the affected browsers until the patch is applied.
  • Validate all WebAuthn assertions on the server side, ensuring the origin and user presence flags match expected values to reduce reliance on the browser’s authentication.

Generated by OpenCVE AI on April 15, 2026 at 16:04 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 13 Apr 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 13 Apr 2026 14:30:00 +0000

Type Values Removed Values Added
Description Spoofing issue in the WebAuthn component in Firefox for Android. This vulnerability affects Firefox < 148 and Thunderbird < 148. Spoofing issue in the WebAuthn component in Firefox for Android. This vulnerability was fixed in Firefox 148 and Thunderbird 148.

Sat, 28 Feb 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Thu, 26 Feb 2026 21:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-290

Wed, 25 Feb 2026 18:00:00 +0000

Type Values Removed Values Added
Weaknesses NVD-CWE-noinfo
CPEs cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Wed, 25 Feb 2026 12:00:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Mozilla thunderbird
Vendors & Products Mozilla
Mozilla firefox
Mozilla thunderbird

Tue, 24 Feb 2026 18:00:00 +0000

Type Values Removed Values Added
Description Spoofing issue in the WebAuthn component in Firefox for Android. This vulnerability affects Firefox < 148. Spoofing issue in the WebAuthn component in Firefox for Android. This vulnerability affects Firefox < 148 and Thunderbird < 148.
References

Tue, 24 Feb 2026 14:00:00 +0000

Type Values Removed Values Added
Description Spoofing issue in the WebAuthn component in Firefox for Android. This vulnerability affects Firefox < 148.
Title Spoofing issue in the WebAuthn component in Firefox for Android
References

Subscriptions

Mozilla Firefox Thunderbird
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-04-13T13:54:24.117Z

Reserved: 2026-02-19T15:06:52.343Z

Link: CVE-2026-2800

cve-icon Vulnrichment

Updated: 2026-02-26T20:33:34.670Z

cve-icon NVD

Status : Modified

Published: 2026-02-24T14:16:28.503

Modified: 2026-04-13T15:17:30.570

Link: CVE-2026-2800

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-02-24T13:33:29Z

Links: CVE-2026-2800 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-15T17:00:07Z

Weaknesses