CVE-2025-1939: low-severity vulnerability in Mozilla Firefox
Tapjacking in Android Custom Tabs using transition animations
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
8Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 3.9epss 0.2%
Android apps can load web pages using the Custom Tabs feature. This feature supports a transition animation that could have been used to trick a user into granting sensitive permissions by hiding what the user was actually clicking. This vulnerability was fixed in Firefox 136.
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Affected products
Mozilla · FirefoxRelated CVEs — Mozilla Firefox
In the same product, most dangerous first.