CVE-2026-2800 describes a spoofing vulnerability in the WebAuthn component of Firefox for Android. WebAuthn is used for secure web authentication, and this flaw could allow attackers to spoof authentication requests. The vulnerability has a high severity rating (CVSS 9.8) indicating network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Mozilla addressed this issue in Firefox 148 and Thunderbird 148 releases. The vendor advisory explicitly lists this vulnerability among multiple high-impact security fixes and confirms it is resolved in the stated versions.

Successful exploitation of this vulnerability could allow an attacker to spoof WebAuthn authentication requests in Firefox for Android, potentially leading to unauthorized access or impersonation. The CVSS score of 9.8 indicates critical impact affecting confidentiality, integrity, and availability. However, no known exploits in the wild have been reported at this time.

Mozilla has released official fixes for this vulnerability in Firefox 148 and Thunderbird 148. Users and administrators should update affected Firefox for Android installations to version 148 or later to mitigate this issue. No additional mitigation steps are indicated by the vendor advisory.