CVE-2025-1939

LOW

Firefox < 136.0 - Permission Spoofing via Custom Tabs Transition Animation

Title source: llm

Description

Android apps can load web pages using the Custom Tabs feature. This feature supports a transition animation that could have been used to trick a user into granting sensitive permissions by hiding what the user was actually clicking. This vulnerability was fixed in Firefox 136.

References (3)

Core 3

Core References

Issue Tracking

https://bugzilla.mozilla.org/show_bug.cgi?id=1928334

Vendor Advisory

https://www.mozilla.org/security/advisories/mfsa2025-14/

Product

https://taptrap.click

Scores

CVSS v3 3.9

EPSS 0.0017

EPSS Percentile 6.7%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-359

Status published

Products (2)

mozilla/firefox < 136.0

Mozilla/Firefox 136

Published Mar 04, 2025

Tracked Since Feb 18, 2026