CVE-2025-1939

Android apps can load web pages using the Custom Tabs feature. This feature supports a transition animation that could have been used to trick a user into granting sensitive permissions by hiding what the user was actually clicking. This vulnerability was fixed in Firefox 136.

• security@mozilla.org
• security@mozilla.org
• af854a3a-2127-422b-91ae-364da2661108