CVE-2025-1940

What it actually does

A UI rendering flaw on Android allows a select dropdown to partially overlay and obscure the confirmation dialog presented before an external application is launched from the browser.

Why it matters to the business

Users on affected Android devices may be tricked into unintentionally launching malicious external applications, potentially resulting in data theft, device compromise, or installation of unwanted software.

How an attack unfolds

An attacker hosts a malicious web page containing a carefully positioned select element. When the user interacts with the page on Android Firefox, the select partially covers the external-app launch confirmation prompt, leading the user to confirm the launch without realizing the target application.

How to fix it

Upgrade all Android Firefox installations to version 136 or later. Until patches can be applied, consider restricting external application launch permissions or using alternative browsers on Android devices.

How to confirm the fix worked

Verify the installed Firefox version is 136 or newer on Android devices; test that external-app confirmation dialogs are no longer partially obscured by select elements on sample pages.

Typical attack path

1. Attacker crafts and hosts a web page with a select element positioned to overlap the external-app confirmation dialog
2. Victim visits the page using the vulnerable Android Firefox version
3. User interaction with the page triggers the partially obscured confirmation prompt
4. User inadvertently confirms the launch of an attacker-chosen external application

How to detect it

Review browser history and external-app launch logs on Android devices for unexpected application invocations following visits to untrusted sites; correlate with web proxy or EDR logs showing access to suspicious domains immediately prior to app launches.

What your security team should do

• Prioritize deployment of Firefox 136+ to all Android endpoints within the next patch cycle
• Communicate the phishing risk to mobile users and encourage prompt updates
• Monitor browser telemetry or MDM reports for version compliance