{"id":"CVE-2026-118018","kind":"vulnerability","aliases":["CVE-2026-118018"],"related":[],"title":"Firefox for Android: Downloads component spoofing issue fixed in 159","description":"Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 159.","summary":"A spoofing flaw in the Downloads component of Firefox for Android could let a page or file mislead the user about what they are downloading. The sources do not describe the exact attacker capability beyond spoofing.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","firefox","mobile","other"],"not_affected_if":["firefox-159-or-later"],"how_to_check":"- Check the installed Firefox for Android version in the app's About page or with `unknown` for a managed fleet tool\n- Confirm whether the device runs a build below `159`","fix":"- Update Firefox for Android to `159` or later through the Play Store or your managed app policy","status":"open","published_at":"2026-10-27T14:16:59+00:00","first_seen_at":"2026-10-27T14:32:25+00:00","triaged_at":"2026-10-27T14:33:26+00:00","updated_at":"2026-10-27T14:33:26+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-10-27T14:33:26Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox for Android to `159` or later through the Play Store or your managed app policy","reach":"internet","title":"Firefox for Android: Downloads component spoofing issue fixed in 159","impact":"low","summary":"A spoofing flaw in the Downloads component of Firefox for Android could let a page or file mislead the user about what they are downloading. The sources do not describe the exact attacker capability beyond spoofing.","category":"other","nicknames":[],"who_cares":["firefox","android","mobile"],"confidence":0.4,"needs_auth":"no","worst_case":"user is misled about a download's origin or name","analyst_note":"","how_to_check":"- Check the installed Firefox for Android version in the app's About page or with `unknown` for a managed fleet tool\n- Confirm whether the device runs a build below `159`","needs_analyst":false,"not_affected_if":["firefox-159-or-later"],"who_is_affected":"Users of Firefox for Android builds older than 159 who download files. Managed fleets should confirm app versions. Desktop Firefox and other browsers are not named in the sources. Anyone already on 159 or later can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"low"},"cost_usd":0.00054,"input_tokens":3235,"output_tokens":433,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118018':13A,16A '-2026':12A,15A '159':10A,72C 'android':3A,17B,30B,65C 'attack':52B 'beyond':54B 'capabl':53B 'compon':5A,26B,61C 'could':31B 'cve':11A,14A 'describ':49B 'download':4A,25B,44B,60C 'exact':51B 'file':36B 'firefox':1A,18B,28B,63C,71C 'fix':8A,69C 'flaw':22B 'issu':7A,57C 'let':32B 'mislead':37B 'mobil':19B 'page':34B 'sourc':46B 'spoof':6A,21B,55B,56C 'user':39B 'vulner':67C","nicknames":[],"mitigations":[],"who_affected":"Users of Firefox for Android builds older than 159 who download files. Managed fleets should confirm app versions. Desktop Firefox and other browsers are not named in the sources. Anyone already on 159 or later can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:59+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118018","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118018","severity":null,"published_at":"2026-10-27T14:16:59+00:00","modified_at":"2026-10-27T14:16:59+00:00","first_seen_at":"2026-10-27T14:32:25+00:00","fetched_at":"2026-10-27T14:32:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}