Firefox for Android contains a heap buffer overflow in the Audio/Video: Playback component. If an attacker can supply crafted audio or video data, the overflow can corrupt the heap, potentially leading to a crash, denial‑of‑service, or execution of arbitrary code. The vulnerability is a classic memory corruption flaw (CWE‑122) that threatens the confidentiality or integrity of data in the affected process.

All Android installations of Mozilla Firefox that are older than version 148.0.2 are affected. The vulnerability was fixed in that release, so any device running Firefox 148.0.2 or newer is no longer susceptible.

The CVSS score of 8.8 classifies this issue as high severity. The EPSS score of less than 1% indicates a very low likelihood of widespread exploitation at present, and the vulnerability is not yet listed in CISA’s Known Exploited Vulnerabilities catalog. Nonetheless, because an attacker can trigger the flaw remotely by delivering malicious media to the browser, the risk remains significant for environments that rely on Firefox for Android. Mitigation through an up‑to‑date Firefox package is the recommended approach.