CVE-2026-2800

CVE-2026-2800 is a spoofing vulnerability in the WebAuthn component of Firefox for Android, as identified by CWE-290. The issue allows attackers to spoof authentication mechanisms within WebAuthn, a standard for secure web authentication using public key cryptography. This flaw affects Firefox for Android versions prior to 148 and was also addressed in Thunderbird 148, indicating potential shared component exposure. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its high impact on confidentiality, integrity, and availability.

A remote attacker requires no privileges or user interaction to exploit this vulnerability over the network with low complexity. Successful exploitation enables high-impact compromise, potentially allowing the attacker to spoof WebAuthn authentications, bypass security checks, and gain unauthorized access to protected resources or impersonate legitimate users in web applications relying on this API.

Mozilla's security advisories (MFSA 2026-13 and MFSA 2026-16) and the associated Bugzilla entry (1988145) confirm the fix in Firefox 148 and Thunderbird 148. Security practitioners should prioritize updating affected browsers to these versions or later to mitigate the risk, as no workarounds are detailed in the provided references.