CVE-2025-1940: Android Intent confirmation prompt tapjacking using Select options
A select option could partially obscure the confirmation prompt shown before launching external apps. This could be used to trick a user in to launching an external app unexpectedly. This issue only affects Android versions of Firefox.. This vulnerability was fixed in Firefox 136.
Other sources
A select option could partially obscure the confirmation prompt shown before launching external apps. This could be used to trick a user in to launching an external app unexpectedly. This issue only affects Android versions of Firefox.
— Mozilla
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-1940?
CVE-2025-1940 has been classified as a moderate severity vulnerability.
How do I fix CVE-2025-1940?
To fix CVE-2025-1940, you need to update Firefox to version 136 or later.
Who is affected by CVE-2025-1940?
CVE-2025-1940 specifically affects users of Firefox on Android running versions prior to 136.
What type of vulnerability is CVE-2025-1940?
CVE-2025-1940 is an issue that could lead to user deception regarding the launching of external applications.
When was CVE-2025-1940 disclosed?
CVE-2025-1940 was disclosed in early 2025.