important · Mobile — Browser
Firefox 155 fixes an Android privilege escalation whose crossed boundary remains undisclosed.
Affects
Firefox for Android, Mozilla's mobile browser on Android devices
The official record requires network delivery and user interaction but no prior privilege, and assigns total confidentiality, integrity and availability impact.
Detail and 2 sources
Mozilla has not disclosed the trigger or resulting privilege, so we cannot distinguish a sandbox escape from a process- or Android-level escalation.
Chain to watch
Deliver an undisclosed network-originated input to Firefox for Android→↓Obtain the required user interaction→↓Cross an undisclosed privilege boundary→↓The trigger and gained privilege remain restricted in Mozilla Bugzilla 2053320.
Unverified chainRetrieve Bugzilla 2053320 when its restriction lifts, or identify the corresponding source patch.
Firefox 155 contains the fix.