This vulnerability in Firefox for Android allows an attacker to bypass the default user prompt that appears when a link is about to be opened in an external application. By circumventing this prompt, an attacker could cause the browser to open external applications without user consent, potentially leading to security or privacy issues in those external apps. The vulnerability is limited to Firefox for Android and was addressed in Firefox 140. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.

An attacker exploiting this vulnerability could bypass the user confirmation prompt before opening links in external applications on Firefox for Android. This could lead to unintended execution of external apps, potentially exposing users to security vulnerabilities or privacy leaks within those applications. There is no direct confidentiality or availability impact on Firefox itself, but the integrity of user actions is affected. Other Firefox versions are not impacted.

This vulnerability has been fixed in Firefox 140. Users and administrators should update Firefox for Android to version 140 or later to remediate this issue. No additional mitigation steps are required once the update is applied.