CVE-2026-2800: 
NixOS vulnerability analysis and mitigation

CVE-2026-2800 is a spoofing vulnerability in the WebAuthn component of Firefox for Android that allows an attacker to bypass the fido:/ URI block using Android's intent:// scheme via a share link. Reported by security researchers hafiizh and kang ali, the vulnerability was disclosed on February 24, 2026, and affects Firefox and Thunderbird versions prior to 148.0. Mozilla rated the impact as moderate in its advisories (MFSA2026-13 and MFSA2026-16), though Feedly's CVSS v3.1 estimate assigns a base score of 9.8 (Critical) (Mozilla Advisory, Mozilla Advisory). The vulnerability is classified under CWE-290 (Authentication Bypass by Spoofing) (Feedly).

The root cause is a case-sensitive URI scheme comparison failure in Firefox for Android's WebAuthn component (CWE-290: Authentication Bypass by Spoofing). Firefox for Android blocks fido:/ URIs to prevent unauthorized FIDO2/WebAuthn interactions, but the check did not account for case variations — an attacker could craft an intent:// URI with scheme=FIDO (uppercase) that bypassed the lowercase fido block. The attack vector involves a malicious web page hosted by an attacker that contains a crafted intent://123456...#Intent;scheme=FIDO;end link; when a victim long-presses the link in another browser (e.g., Chrome) and shares it to Firefox, Firefox processes the intent and triggers the Google Play service dialog, enabling FIDO2 account hijacking and 2FA bypass (Mozilla Bugzilla). The fix involved comparing the URI scheme in a case-insensitive manner in the Android Components layer (Mozilla Bugzilla).

Successful exploitation allows an attacker to hijack FIDO2/WebAuthn-protected accounts and bypass two-factor authentication on Android devices running vulnerable versions of Firefox. The attacker can impersonate legitimate authentication services, tricking users into completing WebAuthn ceremonies against attacker-controlled origins. This primarily affects confidentiality and integrity — an attacker gaining unauthorized account access could exfiltrate sensitive data or perform actions on behalf of the victim (Mozilla Advisory, Mozilla Bugzilla).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of disclosure (Feedly). The vulnerability requires social engineering — the victim must long-press a malicious link in another browser and manually share it to Firefox for Android, limiting opportunistic exploitation. The EPSS score is 0.000170 (very low probability of exploitation in the near term), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly). No threat actor attribution has been reported.

1. Set up malicious page: Host a web page (e.g., https://attacker.com/fido1.html) containing a crafted link with the URI intent://123456...#Intent;scheme=FIDO;end, where FIDO is uppercase to bypass Firefox's case-sensitive block on fido:/ URIs.
2. Lure victim to the page: Direct the target to open the malicious page using a browser other than Firefox for Android (e.g., Google Chrome).
3. Trigger share action: Instruct or socially engineer the victim to long-press the intent:// link on the page, which surfaces Android's share menu.
4. Share to Firefox: The victim selects Firefox for Android as the share target and taps "Open."
5. Exploit WebAuthn bypass: Firefox for Android receives the intent, fails to block it due to the case mismatch (FIDO vs. fido), and presents a "Open in Google Play service" dialog — enabling the attacker to initiate a FIDO2/WebAuthn authentication ceremony against a spoofed origin, potentially hijacking the victim's account or bypassing 2FA (Mozilla Bugzilla).

• Network: Outbound connections from a Firefox for Android device to unexpected or attacker-controlled domains following a link-share action from another browser.
• Logs: Android system logs showing Firefox for Android receiving and processing intent:// URIs with scheme=FIDO (uppercase) from external share actions.
• User Behavior: Unexpected "Open in Google Play service" dialogs appearing in Firefox for Android after sharing a link from Chrome or another browser — this dialog should not appear on patched versions.
• WebAuthn Events: Unexpected or unsolicited FIDO2/WebAuthn authentication prompts in Firefox for Android not initiated by the user visiting a legitimate site directly.

Mozilla has released patches in Firefox 148 and Thunderbird 148, which fix the case-insensitive URI scheme comparison in the WebAuthn component. All users of Firefox for Android and Thunderbird below version 148.0 should update immediately via the Google Play Store or Mozilla's official download channels (Mozilla Advisory, Mozilla Advisory). No configuration-based workaround is available; upgrading to version 148.0 or later is the only remediation. As an interim measure, users can avoid sharing links from other browsers to Firefox for Android until the update is applied.

The vulnerability was reported by external security researchers hafiizh and kang ali, who received a Mozilla security bug bounty for the discovery (Mozilla Bugzilla). The bug was noted as related to a similar previously reported Chromium issue (issues.chromium.org/issues/401823929) and a prior Firefox bug (CVE-2025-10530), indicating a pattern of intent:// URI handling weaknesses across mobile browsers. Coverage appeared on security aggregators and social media platforms including Bluesky and Mastodon shortly after disclosure, though no major media coverage or significant community controversy was observed.