{"id":"CVE-2026-124911","kind":"vulnerability","aliases":["CVE-2026-124911"],"related":[],"title":"Firefox for Android: Autofill clickjacking flaw lets a page trick taps","description":"Clickjacking issue in the Autofill component in Firefox for Android. This vulnerability was fixed in Firefox 160.","summary":"The Autofill component in Firefox for Android can be abused for clickjacking, where a malicious page disguises an element so a user clicks something they did not intend. The description states the issue was fixed in Firefox 160.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","firefox","mobile","other"],"not_affected_if":["firefox-160-or-newer"],"how_to_check":"- Check the installed Firefox for Android version in the app's settings (About Firefox)\n- Versions below `160` are covered by the fix named in the sources","fix":"- Firefox for Android: `160`","status":"open","published_at":"2026-11-10T14:17:24+00:00","first_seen_at":"2026-11-10T14:22:17+00:00","triaged_at":"2026-11-10T14:24:40+00:00","updated_at":"2026-11-10T14:24:40+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-10T14:24:40Z","model":"claude-haiku-5-5","output":{"fix":"- Firefox for Android: `160`","reach":"internet","title":"Firefox for Android: Autofill clickjacking flaw lets a page trick taps","impact":"low","summary":"The Autofill component in Firefox for Android can be abused for clickjacking, where a malicious page disguises an element so a user clicks something they did not intend. The description states the issue was fixed in Firefox 160.","audience":"everyone","category":"other","nicknames":[],"who_cares":["firefox","android","mobile"],"confidence":0.5,"fix_status":"available","needs_auth":"unknown","worst_case":"A malicious page tricks a user into tapping hidden controls","analyst_note":"","how_to_check":"- Check the installed Firefox for Android version in the app's settings (About Firefox)\n- Versions below `160` are covered by the fix named in the sources","plain_action":"Update Firefox on your Android phone to version 160 or newer through the Play Store.","product_name":"","needs_analyst":false,"not_affected_if":["firefox-160-or-newer"],"who_is_affected":"Only people using Firefox for Android with the Autofill component are affected by this clickjacking flaw. The sources do not describe exploitation conditions beyond the component name. Teams that only manage desktop browsers or other products can skip it.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000695,"input_tokens":4473,"output_tokens":495,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-124911':14A,17A '-2026':13A,16A '160':58B,75C 'abus':30B 'android':3A,18B,27B,68C 'autofil':4A,22B,63C 'click':43B 'clickjack':5A,32B,59C 'compon':23B,64C 'cve':12A,15A 'descript':50B 'disguis':37B 'element':39B 'firefox':1A,19B,25B,57B,66C,74C 'fix':55B,72C 'flaw':6A 'intend':48B 'issu':53B,60C 'let':7A 'malici':35B 'mobil':20B 'page':9A,36B 'someth':44B 'state':51B 'tap':11A 'trick':10A 'user':42B 'vulner':70C","nicknames":[],"mitigations":[],"who_affected":"Only people using Firefox for Android with the Autofill component are affected by this clickjacking flaw. The sources do not describe exploitation conditions beyond the component name. Teams that only manage desktop browsers or other products can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Firefox on your Android phone to version 160 or newer through the Play Store.","pkeys":[],"ptokens":[],"labels":["android","firefox","mobile","other","unknown"],"campaign_type":null,"search_a":"'-124911':14A,17A '-2026':13A,16A 'android':3A 'autofil':4A 'clickjack':5A 'cve':12A,15A 'firefox':1A 'flaw':6A 'let':7A 'page':9A 'tap':11A 'trick':10A","search_b":"'160':58B 'abus':30B 'android':18B,27B 'autofil':22B 'click':43B 'clickjack':32B 'compon':23B 'descript':50B 'disguis':37B 'element':39B 'firefox':19B,25B,57B 'fix':55B 'intend':48B 'issu':53B 'malici':35B 'mobil':20B 'page':36B 'someth':44B 'state':51B 'user':42B","search_c":"'160':75C 'android':68C 'autofil':63C 'clickjack':59C 'compon':64C 'firefox':66C,74C 'fix':72C 'issu':60C 'vulner':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T14:17:24+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124911","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124911","severity":null,"published_at":"2026-11-10T14:17:24+00:00","modified_at":"2026-11-10T14:17:24+00:00","first_seen_at":"2026-11-10T14:22:17+00:00","fetched_at":"2026-11-10T14:22:17+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}