CVE-2026-74975 Overview
CVE-2026-74975 is a spoofing vulnerability in the Downloads component of Firefox for Android. The flaw enables an attacker-controlled web page to misrepresent download information to the user, aligning with user interface (UI) misrepresentation of critical information [CWE-451]. Mozilla resolved the issue in Firefox 154. Exploitation requires user interaction and a network-based attack path, but no elevated privileges. The impact affects confidentiality and availability at a limited level, with no integrity impact.
Critical Impact
An attacker can trick mobile users into trusting or executing spoofed download content, enabling phishing and malware delivery scenarios against Firefox for Android users.
Affected Products
- Mozilla Firefox for Android (versions prior to 154)
Discovery Timeline
- 2026-08-18 - CVE-2026-74975 published to NVD
- 2026-08-18 - Last updated in NVD database
Technical Details for CVE-2026-74975
Vulnerability Analysis
The vulnerability resides in the Downloads component of Firefox for Android. It permits spoofing of information presented to the user during the file download workflow. Because the Downloads UI is a trust anchor for users evaluating whether to open or retain a file, spoofed metadata (such as file name, origin, or type) can lead users to interact with malicious content believing it originated from a trusted source.
The issue is classified under [CWE-451] User Interface (UI) Misrepresentation of Critical Information. Firefox 154 contains the fix. Exploitation depends on the user visiting an attacker-controlled page and interacting with a crafted download prompt.
Root Cause
The root cause is improper representation of security-relevant download attributes in the Firefox for Android Downloads component. The component fails to consistently render authoritative origin or file metadata, allowing an attacker page to influence what the user sees. Refer to the Mozilla Bug Report #1842361 and the Mozilla Security Advisory MFSA-2026-74 for authoritative technical details.
Attack Vector
The attack is network-based and requires user interaction. An attacker hosts a malicious page that triggers a download in Firefox for Android. The Downloads component then presents misleading information about the file, encouraging the user to open or trust a payload delivered by the attacker. No authentication is required to reach the vulnerable code path.
No verified proof-of-concept code is publicly available. See the referenced Mozilla advisory for technical details.
Detection Methods for CVE-2026-74975
Indicators of Compromise
- Firefox for Android installations reporting a version earlier than 154 in mobile device management (MDM) inventory.
- Downloads to mobile endpoints where the source URL and displayed origin diverge in browser telemetry or proxy logs.
- Users reporting unexpected file names, extensions, or origins after initiating downloads in Firefox for Android.
Detection Strategies
- Inventory Firefox for Android versions across managed mobile fleets and flag hosts running versions below 154.
- Correlate web proxy logs with mobile endpoint download events to identify origin mismatches consistent with UI spoofing.
- Monitor for downloads of executable or archive file types delivered to Android devices from low-reputation domains.
Monitoring Recommendations
- Enable mobile threat defense telemetry to capture browser download events and file provenance metadata.
- Alert on installations of sideloaded APKs or unexpected document formats immediately following a Firefox download event.
- Review user-reported phishing incidents involving mobile browsers for patterns consistent with download spoofing.
How to Mitigate CVE-2026-74975
Immediate Actions Required
- Update Firefox for Android to version 154 or later through Google Play or the Mozilla release channel.
- Communicate the risk to mobile users and instruct them to verify download origins before opening files.
- Enforce automatic browser updates through mobile device management policies where supported.
Patch Information
Mozilla fixed CVE-2026-74975 in Firefox 154. Details are documented in the Mozilla Security Advisory MFSA-2026-74. Administrators should confirm that managed Android devices have received the update and that older Firefox builds are removed from enterprise app catalogs.
Workarounds
- Restrict use of Firefox for Android on managed devices until the update to version 154 is verified across the fleet.
- Route mobile browser traffic through a secure web gateway that inspects and blocks high-risk download types.
- Disable installation of applications from unknown sources on Android devices to limit the impact of spoofed downloads.
# Verify installed Firefox for Android version via adb
adb shell dumpsys package org.mozilla.firefox | grep versionName
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
