This vulnerability (CVE-2025-1940) affects only the Android version of Mozilla Firefox. It involves a tapjacking issue where a select option element can partially cover the confirmation prompt that appears before launching external applications. This UI obscuration could be exploited to deceive users into launching external apps without their explicit intent. The vulnerability was addressed and fixed in Firefox 136. The CVSS 3.1 base score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N), reflecting a network attack vector with low attack complexity, no privileges required, user interaction needed, and high confidentiality impact with limited integrity impact. The vendor advisory confirms the fix in Firefox 136 and does not report any active exploitation.

The impact of this vulnerability is that an attacker could trick a user into unintentionally launching an external application by partially obscuring the confirmation prompt with a select option UI element. This could lead to unintended app launches, potentially exposing the user to further risks depending on the external app's behavior. The confidentiality impact is rated high, while integrity impact is low, and availability is not affected. This vulnerability is limited to Firefox on Android devices.

Mozilla fixed this vulnerability in Firefox version 136. Users of Firefox on Android should update to version 136 or later to remediate this issue. There is no indication from the vendor advisory that additional mitigations or workarounds are required. Patch status is confirmed as fixed in Firefox 136.