# CVE-2026-74975: Mozilla Firefox for Android spoofing in Downloads component

Source: https://junglewise.ai/threats/cve-2026-74975-mozilla-firefox-for-android-spoofing-in-downloads-component  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-74975 · Severity: medium · CVSS 5.4 · Published 2026-08-18

Firefox for Android's download confirmation notification can be displayed on top of content from other websites, allowing attackers to trick users into believing a download prompt is legitimate when it actually originates from a malicious site. An attacker can redirect a user to a legitimate website while keeping the download notification visible, deceiving the user into thinking the notification is from that site rather than the attacker's origin.

Technologies: [Mozilla Firefox for Android](https://junglewise.ai/threats/technologies/firefox-for-android), [Mozilla Firefox Mobile](https://junglewise.ai/threats/technologies/firefox-mobile). Vendors: [Mozilla](https://junglewise.ai/threats/vendors/mozilla).

## Quick answers

**Is CVE-2026-74975 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-74975 being exploited in the wild.

**How severe is CVE-2026-74975?** Medium severity, with a CVSS score of 5.4, published 18 August 2026.

**Which products and versions are affected?** Mozilla Firefox for Android before 154.

**Is there a fix for CVE-2026-74975?** A patch was published on 2026: Fixed in Firefox 154 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-74975 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-74975?** Check whether you run Mozilla Firefox for Android or Mozilla Firefox Mobile at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a spoofing vulnerability in the Downloads component of Firefox for Android caused by improper UI overlay handling. The download confirmation notification dialog fails to disappear when the user navigates to a different origin, allowing an attacker to display a download prompt on top of legitimate site content. An attacker can craft a malicious page that initiates a download, then automatically redirects to a popular website (such as Google) while keeping the download notification visible, leading the user to believe the notification originates from the legitimate site. The vulnerability requires user interaction (clicking a link) but no authentication. The issue was fixed in Firefox 154.

## Affected products

- Mozilla Firefox for Android before 154

## Timeline

- 2026-08-18: disclosed
- 2026: patched: Fixed in Firefox 154

## References

- [https://bugzilla.mozilla.org/show_bug.cgi?id=1842361](https://bugzilla.mozilla.org/show_bug.cgi?id=1842361)
- [https://www.mozilla.org/security/advisories/mfsa2026-74/](https://www.mozilla.org/security/advisories/mfsa2026-74/)

## Related threats

- [Firefox for Android Media component unspecified issue](https://junglewise.ai/threats/cve-2026-124937-other-issue-in-the-media-component-in-firefox-for-android-this)
- [Firefox Spoofing issue in Downloads component for Android](https://junglewise.ai/threats/cve-2026-118018-spoofing-issue-in-the-downloads-component-in-firefox-for-android)
- [Firefox for Android Downloads spoofing in filename display](https://junglewise.ai/threats/cve-2026-100823-spoofing-issue-in-the-downloads-component-in-firefox-for-android)
- [Mozilla Firefox Focus for Android other issue](https://junglewise.ai/threats/cve-2026-84135-mozilla-firefox-focus-for-android-other-issue)
- [Mozilla Firefox for Android information disclosure in WebExtensions](https://junglewise.ai/threats/cve-2026-84127-mozilla-firefox-for-android-information-disclosure-in)