CVE-2026-74951: Firefox for Android Clickjacking Vulnerability

CVE-2026-74951 Overview

CVE-2026-74951 is a clickjacking vulnerability affecting Mozilla Firefox for Android. The flaw allows a malicious website to trick users into performing unintended actions by disguising or overlaying user interface elements. Mozilla addressed the issue in Firefox 154 through security advisory MFSA-2026-74. The vulnerability maps to CWE-1021: Improper Restriction of Rendered UI Layers or Frames and requires user interaction to succeed.

Critical Impact
A remote attacker hosting a crafted web page can manipulate the Firefox for Android interface to induce unintended user actions, potentially altering integrity-sensitive state within the browser.

Affected Products

Mozilla Firefox for Android versions prior to 154
Mozilla Firefox Mobile on the Android platform
Devices running vulnerable Firefox Mobile builds distributed through Google Play and Mozilla channels

Discovery Timeline

2026-08-18 - CVE-2026-74951 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-74951

Vulnerability Analysis

The vulnerability is a clickjacking flaw in the Android build of Firefox. Clickjacking (also known as UI redress) allows a malicious page to overlay or reframe browser or web-content controls so a user believes they are interacting with one element while actually activating another. On mobile browsers, the smaller viewport and touch-based interaction model expand the attack surface, since users cannot easily inspect overlaid elements or hover states.

Successful exploitation requires the victim to visit an attacker-controlled page and perform a tap or gesture. There is no impact to confidentiality or availability, but integrity can be affected because the user may unknowingly submit forms, grant browser permissions, or perform state-changing operations.

Root Cause

The root cause is improper restriction of rendered UI layers or frames [CWE-1021]. Firefox for Android did not sufficiently isolate or validate the visual context of security-relevant interactions, allowing a crafted page to disguise the origin or purpose of a control the user was about to activate.

Attack Vector

The attack vector is network-based. An attacker hosts a malicious web page that a user opens in a vulnerable Firefox for Android build. The page uses overlays, transparent frames, or timed UI transitions to redirect the user's tap. Refer to the Mozilla Security Advisory MFSA-2026-74 and Mozilla Bug Report #1978587 for vendor-supplied technical detail. No public proof-of-concept, exploit code, or in-the-wild exploitation has been reported.

Detection Methods for CVE-2026-74951

Indicators of Compromise

Firefox for Android installations reporting a version earlier than 154 in enterprise mobile device management (MDM) inventories.
Mobile web traffic to unfamiliar domains that serve pages containing stacked iframes, transparent overlays, or off-screen positioned interactive elements.
User reports of unexpected browser permission prompts or state changes after visiting untrusted sites.

Detection Strategies

Inventory Firefox Mobile versions across managed Android endpoints and flag any build prior to 154.
Inspect web proxy or secure web gateway logs for pages that combine iframes referencing sensitive origins with CSS opacity or pointer-events manipulation.
Correlate mobile browser telemetry with visits to newly registered or low-reputation domains that target Android user agents.

Monitoring Recommendations

Track patch compliance for Firefox for Android through MDM and mobile threat defense dashboards.
Monitor for phishing campaigns delivering links designed for mobile viewports, since clickjacking payloads on mobile are typically distributed by SMS, messaging apps, or social platforms.
Alert on repeated end-user reports of accidental taps or unexpected navigation from a common set of external URLs.

How to Mitigate CVE-2026-74951

Immediate Actions Required

Update Firefox for Android to version 154 or later on all managed and personal devices.
Push the update through MDM or Google Play managed configurations to enforce timely deployment.
Communicate the risk to users and instruct them to avoid opening untrusted links in Firefox until updates are applied.

Patch Information

Mozilla fixed the issue in Firefox 154. Full remediation details are documented in the Mozilla Security Advisory MFSA-2026-74 and tracked in Mozilla Bug Report #1978587. Applying the vendor patch is the only complete remediation.

Workarounds

Use an alternative, fully patched mobile browser until Firefox for Android can be updated to 154.
Restrict browsing on sensitive Android devices to trusted origins through URL filtering on the corporate network or VPN.
Educate users to verify the visible target of any tap on unfamiliar sites and to decline unexpected permission prompts.

bash

# Verify installed Firefox for Android version via adb
adb shell dumpsys package org.mozilla.firefox | grep versionName

# Expected output after remediation:
# versionName=154.0 (or later)