CVE-2025-1939

What it actually does

The flaw permits a malicious Android application to abuse the Custom Tabs transition animation in Firefox to visually obscure permission request dialogs, causing the user to inadvertently authorize sensitive permissions without full awareness of the action.

Why it matters to the business

Organizations face elevated risk of unauthorized permission grants on Android devices, potentially resulting in data leakage, privacy violations, or compromised user accounts when Firefox is used for web interactions.

How an attack unfolds

An attacker creates a malicious Android app that launches a Custom Tab with a carefully timed transition animation; the animation hides or overlays the permission grant interface so the user clicks what appears to be an innocuous button but actually approves the permission request.

How to fix it

Upgrade Mozilla Firefox on Android to version 136 or later to disable the exploitable animation behavior in Custom Tabs.

How to confirm the fix worked

Verify the installed Firefox version is 136 or higher via the application settings or package manager; test Custom Tab permission flows with known animation-triggering apps to confirm dialogs are no longer obscured.

Typical attack path

1. User installs a malicious Android application from an untrusted source.
2. The app opens a web page inside a Firefox Custom Tab.
3. The app triggers a transition animation that conceals the permission prompt.
4. The user interacts with the visible UI elements, inadvertently granting sensitive permissions.
5. The app abuses the newly granted permissions to access protected data or functionality.

How to detect it

Review Android application logs and Firefox crash or permission audit logs for unexpected Custom Tab launches followed immediately by permission grants; correlate with app installation timestamps from package manager history.

What your security team should do

• Prioritize deployment of Firefox 136+ across all Android endpoints within 30 days given the authorization bypass nature.
• Monitor for new Firefox releases and integrate automatic update policies for the browser.
• Educate users on verifying app sources and reviewing permission requests carefully when using browser features.
• Review mobile application allow-lists to reduce exposure to untrusted apps that could leverage Custom Tabs.