Firefox for Android allowed a sandboxed iframe without the `allow-downloads` attribute to start downloads. This vulnerability was fixed in Firefox 141.
The sandbox mechanism for HTML iframe elements provides an `allow-downloads` attribute, which must be explicitly granted for a frame to initiate file downloads. In Firefox for Android, the control of this permission was implemented incorrectly (CWE-732 — Incorrect Permission Assignment for Resource), as a result a sandboxed iframe without the `allow-downloads` attribute could still initiate file downloads. An attacker could place a malicious iframe on a controlled website and initiate downloads without the user's knowledge or consent.
An attacker can initiate the download of arbitrary files on a user's device without required permissions, which may lead to the delivery of malicious software or unauthorized file writes on an Android device.
Firefox for Android should be updated to version 141 or later, in which the vulnerability has been fixed. The update is available through the Google Play Store.
Mozilla Firefox for Android in versions prior to Firefox 141 (on Google Android devices)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HGoogle Android
OSGoogleall versionsMozilla Firefox
APPMozilla< 141.0
Related vulnerabilities
Use-after-free w Animation timelines Firefox/Thunderbird — RCE
Use-after-free w WebGPU IPC framework Mozilla — sandbox escape
Heap buffer overflow w Google Chrome na Android — sandbox escape
Mozilla Firefox/Thunderbird: przełamanie sandbox przez IPC Prompt:Open
Adobe Flash Player — RCE lub DoS przez nieokreślone wektory ataku