# CVE-2026-74980: Mozilla Firefox for Android clickjacking in Downloads component

Source: https://junglewise.ai/threats/cve-2026-74980-mozilla-firefox-for-android-clickjacking-in-downloads-component  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-74980 · Severity: medium · CVSS 6.5 · Published 2026-08-18

Firefox for Android's Downloads component is vulnerable to clickjacking attacks, where a malicious website can trick users into performing unintended actions on download prompts. An attacker could overlay transparent frames to deceive users into authorizing downloads or taking other actions without their knowledge, potentially leading to unwanted file installation or data exposure.

Technologies: [Mozilla Firefox for Android](https://junglewise.ai/threats/technologies/firefox-for-android), [Mozilla Firefox Mobile](https://junglewise.ai/threats/technologies/firefox-mobile). Vendors: [Mozilla](https://junglewise.ai/threats/vendors/mozilla).

## Quick answers

**Is CVE-2026-74980 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-74980 being exploited in the wild.

**How severe is CVE-2026-74980?** Medium severity, with a CVSS score of 6.5, published 18 August 2026.

**Which products and versions are affected?** Mozilla Firefox for Android before 154.

**Is there a fix for CVE-2026-74980?** A patch was published on 2026-08-18: Fixed in Firefox 154 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-74980 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-74980?** Check whether you run Mozilla Firefox for Android or Mozilla Firefox Mobile at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a clickjacking vulnerability in the Downloads component of Firefox for Android. The vulnerability stems from insufficient UI protection against clickjacking attacks, where transparent overlays can be layered on top of download dialogs to trick users into clicking on interface elements they believe they are interacting with. The attack is network-based and requires user interaction (visiting a malicious website). An attacker can deceive users into authorizing downloads or performing unintended actions. Firefox patched this vulnerability in version 154, released in August 2026.

## Affected products

- Mozilla Firefox for Android before 154

## Timeline

- 2026-08-18: disclosed
- 2026-08-18: patched: Fixed in Firefox 154

## References

- [https://bugzilla.mozilla.org/show_bug.cgi?id=2049034](https://bugzilla.mozilla.org/show_bug.cgi?id=2049034)
- [https://www.mozilla.org/security/advisories/mfsa2026-74/](https://www.mozilla.org/security/advisories/mfsa2026-74/)

## Related threats

- [Firefox for Android Media component unspecified issue](https://junglewise.ai/threats/cve-2026-124937-other-issue-in-the-media-component-in-firefox-for-android-this)
- [Firefox Spoofing issue in Downloads component for Android](https://junglewise.ai/threats/cve-2026-118018-spoofing-issue-in-the-downloads-component-in-firefox-for-android)
- [Firefox for Android Downloads spoofing in filename display](https://junglewise.ai/threats/cve-2026-100823-spoofing-issue-in-the-downloads-component-in-firefox-for-android)
- [Mozilla Firefox Focus for Android other issue](https://junglewise.ai/threats/cve-2026-84135-mozilla-firefox-focus-for-android-other-issue)
- [Mozilla Firefox for Android information disclosure in WebExtensions](https://junglewise.ai/threats/cve-2026-84127-mozilla-firefox-for-android-information-disclosure-in)