Medium firefox Logic Error 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionSpoofing issue in the WebAuthn component in Firefox for Android
ComponentCore
Bug ClassLogic Error
Tracker1974025
Fix commitf1d4ce34344c (firefox) +6/-3
CISA KEVNot listed
CreditedHafiizh & Kang Ali
Disclosed2025-09-16

Changed Functions

FunctionChangeNotes
if
mobile/android/geckoview/src/main/java/org/mozilla/gecko/util/IntentUtils.java
modified

Files Changed

  • mobile/android/geckoview/src/main/java/org/mozilla/gecko/util/IntentUtils.java
diff --git a/mobile/android/geckoview/src/main/java/org/mozilla/gecko/util/IntentUtils.java b/mobile/android/geckoview/src/main/java/org/mozilla/gecko/util/IntentUtils.java
index 463f75c777b..b1bb4687ef4 100644
--- a/mobile/android/geckoview/src/main/java/org/mozilla/gecko/util/IntentUtils.java
+++ b/mobile/android/geckoview/src/main/java/org/mozilla/gecko/util/IntentUtils.java
@@ -89,7 +89,7 @@ public class IntentUtils {
     }
 
     if (("intent".equals(scheme) || "android-app".equals(scheme))) {
-      // Bug 1356893 - Rject intents with file data schemes.
+      // Bug 1356893 - Reject intents with file data schemes.
       return getSafeIntent(aUri) != null;
     }
 
@@ -115,8 +115,11 @@ public class IntentUtils {
     }
 
     final Uri data = intent.getData();
-    if (data != null && "file".equals(normalizeUriScheme(data).getScheme())) {
-      return null;
+    if (data != null) {
+      final String scheme = normalizeUriScheme(data).getScheme();
+      if ("file".equals(scheme) || "fido".equals(scheme)) {
+        return null;
+      }
     }
 
     // Only open applications which can accept arbitrary data from a browser.
Loading diff…