CVE-2026-100823

MediumCVSS 5.4

Published: 29/09/2026(UTC)Updated: 05/10/2026(UTC)Translated: 29/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

5th percentile - higher than 5% of all known CVEs

Summary

Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 157.

Risk Assessment

A spoofing issue in the downloads component may mislead users about the origin or content of a downloaded file, potentially leading to download of malicious content. It affects Firefox for Android users running versions older than 157.

Recommendation

Update Firefox for Android to version 157. Notify mobile users about the required update.

Other vulnerabilities in Firefox for Android

See all

CVE-2026-118018Unknown
A spoofing issue exists in the Downloads component of Firefox for Android. This vulnerability was fixed in Firefox 159.
CVE-2023-29534Critical
In Firefox and Focus for Android, techniques were discovered to obscure the fullscreen notification, which could lead to user confusion and spoofing attacks. This affects Firefox for Android and Focus for Android versions prior to 112.
CVE-2026-92033High
Privilege escalation vulnerability in Firefox for Android. Fixed in Firefox 156.
CVE-2026-84117High
Privilege escalation in Firefox for Android. Fixed in Firefox 155.
CVE-2026-74975Medium
A spoofing issue exists in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154.
CVE-2026-18809Medium
Information disclosure in Firefox for Android and Firefox Focus for Android. This vulnerability was fixed in Firefox 153.0.3.
CVE-2026-16397Medium
Clickjacking vulnerability in the WebExtensions component in Firefox for Android. This issue was fixed in Firefox 153.
CVE-2026-16373High
Vulnerability in the Privacy component in Firefox for Android. The flaw leads to information disclosure. The issue was fixed in Firefox 153.
CVE-2026-8951Medium
A spoofing issue exists in the Toolbar component in Firefox for Android. This vulnerability was fixed in Firefox 151.
CVE-2025-10530Medium
A spoofing issue exists in the WebAuthn component in Firefox for Android. This vulnerability was fixed in Firefox 143 and Thunderbird 143.

Original NVD description (English source)

Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 157.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS