The vulnerability CVE-2025-1939 affects Mozilla Firefox on Android devices using the Custom Tabs feature. This feature supports transition animations that could be exploited to mislead users into granting sensitive permissions by hiding the true target of their clicks (tapjacking). The issue was resolved in Firefox 136 as per the Mozilla Foundation Security Advisory 2025-14. The CVSS 3.1 base score is 3.9 (low severity) with attack vector local, low attack complexity, low privileges required, and user interaction needed. No known active exploits have been reported.

If exploited, this vulnerability could allow an attacker to trick a user into granting sensitive permissions unintentionally by manipulating the UI through transition animations in Android Custom Tabs. The impact is limited to confidentiality and integrity with no availability impact. The low CVSS score reflects the requirement for user interaction and local attack vector, reducing the overall risk. There are no reports of active exploitation in the wild.

This vulnerability is fixed in Mozilla Firefox version 136. Users and administrators should update to Firefox 136 or later to remediate this issue. No additional mitigation actions are required beyond applying the official update.