Android apps can load web pages using the Custom Tabs feature. This feature supports a transition animation that could have been used to trick a user into granting sensitive permissions by hiding wha…

Low CVSS 3.9

CVECVE-2025-1939

First seen2026-09-30 20:31 UTC

Disclosed2025-03-04 14:15 UTC

Last updated2026-10-05 16:16 UTC

Channel statusauto

Summary

Android apps can load web pages using the Custom Tabs feature. This feature supports a transition animation that could have been used to trick a user into granting sensitive permissions by hiding what the user was actually clicking. This vulnerability was fixed in Firefox 136.

In-depth triage

No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).

Affected products

Sources

NVD DATABASE

Original Links

https://bugzilla.mozilla.org/show_bug.cgi?id=1928334 Issue Tracking
https://www.mozilla.org/security/advisories/mfsa2025-14/ Vendor Advisory
https://taptrap.click Product

Timeline

2026-09-30 nvd_ingest NVD