CVE-2025-1939
Tapjacking in Android Custom Tabs using transition animations
Android apps can load web pages using the Custom Tabs feature. This feature supports a transition animation that could have been used to trick a user into granting sensitive permissions by hiding what the user was actually clicking. This vulnerability was fixed in Firefox 136.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Tapjacking in Android Custom Tabs using transition animations
Android apps can load web pages using the Custom Tabs feature. This feature supports a transition animation that could have been used to trick a user into granting sensitive permissions by hiding what the user was actually clicking. This vulnerability was fixed in Firefox 136.
- Record
CVE-2025-1939- CVSS 3.1
- 3.9 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-359
- Updated
- 2026-11-02
EUVDEUVD-2025-6162
Android apps can load web pages using the Custom Tabs feature. This feature supports a transition animation that could have been used to trick a user into granting sensitive permissions by hiding what the user was actually clicking. This vulnerability was fixed in Firefox 136.
- Record
EUVD-2025-6162- CVSS 3.1
- 3.9 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-x9h6-qwxm-528g
Android apps can load web pages using the Custom Tabs feature. This feature supports a transition...
Android apps can load web pages using the Custom Tabs feature. This feature supports a transition animation that could have been used to trick a user into granting sensitive permissions by hiding what the user was actually clicking. This vulnerability affects Firefox < 136.
- Record
GHSA-x9h6-qwxm-528g- CVSS 3.1
- 3.9 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-359
- Updated
- 2026-11-02
NVD
Android apps can load web pages using the Custom Tabs feature. This feature supports a transition animation that could have been used to trick a user into granting sensitive permissions by hiding what the user was actually clicking. This vulnerability was fixed in Firefox 136.
- Record
CVE-2025-1939- CVSS 3.1
- 3.9 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-359
- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:14861-1 No score
MozillaFirefox-136.0-1.1 on GA media
These are all security issues fixed in the MozillaFirefox-136.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:14861-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11373-1 No score
firefox-esr-153.0-1.1 on GA media
These are all security issues fixed in the firefox-esr-153.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11373-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
MozillaFirefoxopenSUSE:Tumbleweed From an advisory covering 15 CVEs |
before 136.0-1.1 | 136.0-1.1 |
firefox-esropenSUSE:Tumbleweed From an advisory covering 228 CVEs |
before 153.0-1.1 | 153.0-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-1939 is a low vulnerability (CVSS 3.9) in Mozilla Firefox, published March 4, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.19%, the 8th percentile. No source names a fixed version.
References
bugzilla.mozilla.org/show_bug.cgi?id=1928334
mozilla.org/security/advisories/mfsa2025-14
taptrap.click
nvd.nist.gov/vuln/detail/CVE-2025-1939
github.com/advisories/GHSA-x9h6-qwxm-528g
lists.opensuse.org/archives/list/[email protected]/thread/ELFCIRFYZHSULQ4OOF6EEX5F4HJ65XAG
Show 194 moreShow less
suse.com/security/cve/CVE-2024-9956
Left out here: 43 references. The JSON record has them.