CVE-2026-74980: Vulnerability in Mozilla Firefox
CVE-2026-74980 is a clickjacking vulnerability in the Downloads component of Firefox for Android. This issue was addressed and fixed in Firefox version 154. The vulnerability has a medium severity rating with a CVSS score of 6.5. It does not impact confidentiality but can lead to high integrity impact, requiring user interaction for exploitation.
AI Analysis
Technical Summary
This vulnerability involves a clickjacking issue in the Downloads component of Firefox for Android. Clickjacking allows an attacker to trick a user into clicking on something different from what the user perceives, potentially leading to unintended actions. The flaw was resolved in Firefox 154. The CVSS vector indicates the attack requires network access, low attack complexity, no privileges, user interaction, and results in high integrity impact without affecting confidentiality or availability.
Potential Impact
The vulnerability could allow an attacker to perform unauthorized actions via clickjacking in the Downloads component on Firefox for Android, potentially compromising the integrity of the affected system. There is no impact on confidentiality or availability. Exploitation requires user interaction.
Mitigation Recommendations
A fix for this vulnerability is available in Firefox version 154. Users and administrators should update Firefox for Android to version 154 or later to remediate this issue. No additional mitigation actions are indicated by the vendor advisory.
CVE-2026-74980: Vulnerability in Mozilla Firefox
Description
CVE-2026-74980 is a clickjacking vulnerability in the Downloads component of Firefox for Android. This issue was addressed and fixed in Firefox version 154. The vulnerability has a medium severity rating with a CVSS score of 6.5. It does not impact confidentiality but can lead to high integrity impact, requiring user interaction for exploitation.
CVSS v3.1
Score 6.5medium
Affected software
Mozilla
Firefox
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability involves a clickjacking issue in the Downloads component of Firefox for Android. Clickjacking allows an attacker to trick a user into clicking on something different from what the user perceives, potentially leading to unintended actions. The flaw was resolved in Firefox 154. The CVSS vector indicates the attack requires network access, low attack complexity, no privileges, user interaction, and results in high integrity impact without affecting confidentiality or availability.
Potential Impact
The vulnerability could allow an attacker to perform unauthorized actions via clickjacking in the Downloads component on Firefox for Android, potentially compromising the integrity of the affected system. There is no impact on confidentiality or availability. Exploitation requires user interaction.
Mitigation Recommendations
A fix for this vulnerability is available in Firefox version 154. Users and administrators should update Firefox for Android to version 154 or later to remediate this issue. No additional mitigation actions are indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mozilla
- Date Reserved
- 2026-08-17T11:59:06.573Z
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://www.mozilla.org/security/advisories/mfsa2026-74/","vendor":"Mozilla"}]
Threat ID: 6a84550bc6e8be03323676ba
Added to database: 08/18/2026, 12:50:19 UTC
Last enriched: 09/11/2026, 21:48:29 UTC
Last updated: 10/02/2026, 02:46:06 UTC
Views: 34
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.