External risk intelligence

Firefox Focus for Android Vulnerability Allows Full Device Compromise.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-84135

This vulnerability affects a mobile application (Firefox Focus for Android). Mobile browser applications are client-side software installed on end-user devices, not internet-facing services, gateways, or appliances, making them inherently unlikely to be exposed as public-facing infrastructure.

Information Disclosure

Mozilla Firefox Mobile

before 155.0

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Firefox Focus for Android, which could allow for significant compromise of data confidentiality, integrity, and availability. This issue has been addressed in a subsequent release.

A critical flaw exists in Firefox Focus for Android.
Affects user data on mobile devices.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted request to a vulnerable version of Firefox Focus for Android. This could allow them to execute arbitrary code or access sensitive information on the device.

No special access needed.
Triggered by user interaction.
Allows arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

A critical vulnerability in Firefox Focus for Android could allow an attacker to remotely impact the application. This could affect the integrity and availability of the application's services, and potentially lead to the disclosure of sensitive information.

Application integrity and availability.
Remote attack vector execution.
Compromised application services.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world action for this vulnerability will likely involve the mobile application owner or a platform team responsible for managing mobile deployments. The first practical step is to identify all instances of the affected mobile application, assess their reachability and business criticality, and then determine the accountable owner for remediation planning.

Identify mobile application owner.
Verify app reachability and criticality.
Plan vendor-coordinated updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Firefox Focus for Android?

Firefox Focus for Android is a specialized mobile web browser designed by Mozilla with a focus on privacy. Unlike standard mobile browsers, it includes built-in ad, content, and tracker blocking by default to minimize data collection. It is a client-side application users install on their personal smartphones or tablets to browse the web with enhanced isolation.

What does CVE-2026-84135 mean?

CVE-2026-84135 identifies a security flaw classified as Improper Input Validation (CWE-20). In simple terms, the software fails to properly check or sanitize the data it receives from external sources. Because it does not safely handle this input, an attacker can provide specially crafted data that causes the application to perform unauthorized actions, potentially compromising the integrity of the device.

How is this vulnerability triggered?

This flaw is triggered when the application processes a specially crafted request. Because it requires the application to handle this specific input, the vulnerability does not trigger through passive exposure or simply having the app installed. Successful exploitation generally relies on the application being actively engaged by the user or responding to external data inputs.

Is this a risk to my organization's servers?

According to Halo Surface Signal, this is unlikely. Because this vulnerability exists in a mobile client application rather than a server-side gateway or appliance, it does not function as public-facing infrastructure. The risk is localized to the specific mobile device running the outdated version of Firefox Focus, rather than your broader network or backend services.

Do I need to update my software?

Yes. The first step for anyone managing mobile device deployments is to update Firefox Focus for Android to version 155.0 or later. Since this issue is resolved in that release, verifying that your mobile instances are updated eliminates the underlying flaw. You should coordinate with your device management or mobile platform teams to ensure these updates are pushed to all affected devices.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.