CVE-2026-8951 Mozilla CVE debrief

Who should care

Organizations and individuals running Firefox for Android versions earlier than 151.0.0 should pay attention, especially if mobile browsers are used for sensitive sign-in, approval, or payment workflows. Mobile device administrators should also confirm that managed Android fleets are on Firefox 151 or later.

Technical summary

NVD classifies the vulnerability as CVSS 3.1 6.5/Medium with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. The affected product scope is Mozilla Firefox for Android before 151.0.0, and the weakness is associated with CWE-290 (authentication/spoofing-related). The available source text identifies the issue as a spoofing problem in the Toolbar component, but does not provide deeper exploit mechanics.

Defensive priority

Medium. The issue is not listed as KEV, but it can mislead users through UI spoofing and carries high integrity impact with no privileges required. Update speed should be normal to expedited for mobile fleets that rely on Firefox for Android.

Recommended defensive actions

• Update Firefox for Android to version 151.0.0 or later.
• Verify that managed Android devices are no longer on Firefox versions earlier than 151.0.0.
• Review any mobile workflows where a spoofed toolbar or browser UI could influence user decisions, especially authentication or approval flows.
• Monitor Mozilla’s security advisory for any follow-up guidance or additional affected-version details.
• If you track vulnerability exposure, mark CVE-2026-8951 as resolved once Firefox 151 is deployed across the fleet.

Evidence notes

The NVD record identifies the vulnerability as a spoofing issue in Firefox for Android’s Toolbar component and lists the affected CPE as mozilla:firefox with versionEndExcluding 151.0.0. The record also provides CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N and CWE-290. Mozilla’s advisory reference is included in the source set, supporting the statement that the issue was fixed in Firefox 151. No exploit details beyond spoofing were provided in the supplied corpus.

Official resources