CVE-2026-2800
📋 TL;DR
A spoofing vulnerability in the WebAuthn component of Firefox for Android allows attackers to potentially impersonate legitimate websites during authentication. This affects Firefox for Android versions below 148. Users relying on WebAuthn for passwordless authentication on Android devices are at risk.
💻 Affected Systems
- Firefox for Android
📦 What is this software?
Firefox by Mozilla
Thunderbird by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
Attackers could trick users into authenticating to malicious websites that appear legitimate, potentially compromising accounts protected by WebAuthn authentication.
Likely Case
Targeted phishing attacks where users are tricked into authenticating on spoofed websites, leading to account compromise.
If Mitigated
With proper user awareness and verification of website URLs, the risk is reduced but not eliminated.
🎯 Exploit Status
Exploitation requires user interaction and convincing phishing techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firefox for Android 148
Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2026-13/
Restart Required: Yes
Instructions:
1. Open Google Play Store 2. Search for Firefox 3. Update to version 148 or higher 4. Restart Firefox
🔧 Temporary Workarounds
Disable WebAuthn
androidTemporarily disable WebAuthn authentication in Firefox settings
🧯 If You Can't Patch
- Use alternative browsers for WebAuthn authentication
- Enable additional authentication factors beyond WebAuthn
🔍 How to Verify
Check if Vulnerable:
Check Firefox version in Settings > About FirefoxCheck Version:
Open Firefox > Settings > About FirefoxVerify Fix Applied:
Confirm version is 148 or higher in Settings > About Firefox📡 Detection & Monitoring
Log Indicators:
- Unusual WebAuthn authentication attempts
- Authentication failures from unexpected domains
Network Indicators:
- Suspicious redirects to similar-looking domains
SIEM Query:
web_authn_failures OR suspicious_domain_auth