CVE-2020-26954Medium· 4.3▾ SunlitWhen accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins. This could be used to gain fullscreen access for UI s…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.6%
0.6% → 0.6%
When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins. This could be used to gain fullscreen access for UI spoofing and could also lead to cross-origin attacks on targeted websites. Note: This issue only affected Firefox for Android. Other operating systems are unaffected.. This vulnerability affects Firefox < 83.
firefox_mobile < 83.0Upgrade past the affected range:
firefox_mobile 83.0Connected by shared product, vendor, weakness, or advisory.
CVE-2020-26964Medium· 6.8If the Remote Debugging via USB feature was enabled in Firefox for Android on an Android version prior to Android 6.0, untrusted apps could have connected to the feature and operated with the privileges of the browser to read and interac…
CVE-2020-26957Medium· 6.5OneCRL was non-functional in the new Firefox for Android due to a missing service initialization
CVE-2020-26955Medium· 6.5When a user downloaded a file in Firefox for Android, if a cookie is set, it would have been re-sent during a subsequent file download operation on the same domain, regardless of whether the original and subsequent request were in privat…
CVE-2026-100823Medium· 5.4Spoofing issue in the Downloads component in Firefox for Android
CVE-2026-92033High· 8.8Privilege escalation in Firefox for Android
CVE-2026-86853Medium· 4.3A malicious webpage could repeatedly trigger external URL schemes, causing system prompts or external application launches