CVE-2025-1940 affects Mozilla Firefox on Android platforms. It involves a tapjacking vulnerability where a select option can partially cover the confirmation prompt that appears before launching external applications. This UI obscuration could be leveraged to deceive users into launching external apps without their explicit intent. Mozilla fixed this vulnerability in Firefox 136 as part of a broader security update addressing multiple issues. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact.

The vulnerability could allow an attacker to trick a user into launching an external application unexpectedly by obscuring the confirmation prompt. This may lead to unintended actions by the user, potentially exposing them to further risks depending on the external app launched. The impact is limited to the Android version of Firefox and requires user interaction. There are no known exploits in the wild at this time.

Mozilla has fixed this vulnerability in Firefox version 136. Users and administrators should update to Firefox 136 or later on Android devices to remediate this issue. No additional mitigation steps are required beyond applying the official update.