Live › vulnerability › CVE-2026-118018
Go to dashboardA spoofing flaw in the Downloads component of Firefox for Android could let a page or file mislead the user about what they are downloading. The sources do not describe the exact attacker capability beyond spoofing.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.
Users of Firefox for Android builds older than 159 who download files. Managed fleets should confirm app versions. Desktop Firefox and other browsers are not named in the sources. Anyone already on 159 or later can skip it.
No product ranges from the sources yet.
unknown for a managed fleet tool159159 or later through the Play Store or your managed app policyEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 159.
This page as .md · .json · in your agent: get_signal("CVE-2026-118018")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.