by Kastro
Paper/Archive/CVE-2026-2800

CVE-2026-2800

Mozilla Firefox — Spoofing issue in the WebAuthn component in Firefox for Android

EPSS 0.3%CVSS 9.8
critical.is priorityof 100
35
CVSS 9.8 (ADP, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 28.6.286 × 205.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Spoofing issue in the WebAuthn component in Firefox for Android. This vulnerability was fixed in Firefox 148 and Thunderbird 148.

Affected

ProductAffectedFixed inSource
Firefoxsee advisory148CNA
Thunderbirdsee advisory148CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refbugzilla.mozilla.org/show_bug.cgi?id=1988145refmozilla.org/security/advisories/mfsa2026-13refmozilla.org/security/advisories/mfsa2026-16