CVE-2026-2800 is a spoofing issue in the WebAuthn component of Firefox for Android. NVD scores it 9.8 (Critical), while Mozilla rates its own impact as moderate. Mozilla fixed it in Firefox 148 on 24 February 2026, so Android users should update through Google Play.
What's affected
The record says the issue is in the WebAuthn component in Firefox for Android, fixed in Firefox 148. The record also lists Thunderbird 148 as a fixed product because Mozilla published the same bug list for it, but the description itself names only Firefox for Android. Mozilla's advisory is MFSA 2026-13.
Mozilla assigns this one a moderate impact, while NVD's automated vector produces 9.8. When the two disagree, read the vendor note as the better guide to practical risk, and still patch, because the fix is a routine update.
Desktop Firefox is not named in the description. I did not find a statement in the sources about whether desktop builds are affected, so check the advisory if that matters to you.
How to check if you're exposed
On an Android device, open Settings, then Apps, then Firefox, and read the version at the bottom of the app info page. You can also open the Firefox menu, then Settings, then About Firefox.
Anything below 148 is in scope. For fleets managed through an MDM, filter the app inventory for Firefox versions below 148.
What to do now
- Update Firefox for Android to 148 or later from Google Play or your managed app store.
- Open the app once after updating so the new version is the one running.
- If you manage devices, push the update and check the reported version afterwards.
- Review where your users rely on passkeys or security keys in Firefox for Android, and note those accounts if you want extra monitoring for a few weeks.
Why it matters
WebAuthn is the browser standard behind passkeys and hardware security keys. Its job is to prove to a site that a person controls a credential, and to prove to the person which site is asking. A spoofing flaw in that layer is classified as CWE-290 (Authentication Bypass by Spoofing): something presents itself as a thing it is not.
The advisory gives no further mechanism, so this post does not guess at one. What can be said is that authentication prompts are a place where users trust what the browser shows them. Bugs there deserve a prompt update even when the vendor calls the impact moderate.
There is no sign in the record that this is exploited, and it is not in the CISA Known Exploited Vulnerabilities catalog.
Quick check
Why does NVD say 9.8 when Mozilla says moderate?
NVD scored the weakness class with a generic vector. Mozilla judges impact in the context of the product and its platform protections. Both can be useful, but the vendor rating reflects how the bug behaves in the browser.
Are passkeys themselves broken?
Nothing in the advisory says so. The issue is a spoofing flaw in how Firefox for Android handles the WebAuthn component, fixed in version 148.
Sources
- Mozilla Foundation Security Advisory 2026-13 (Firefox 148)
- Mozilla Foundation Security Advisory 2026-16 (Thunderbird 148)
Last reviewed: 19 October 2026.
