Lightweight themes on Firefox for Android do not verify a secure connection

ID MFSA2016-12
Type mozilla
Reporter Mozilla Foundation
Modified 2016-01-26T00:00:00


Mozilla developer Margaret Leibovic reported when Firefox for Android installs lightweight themes, it does not check to verify that they are served over an HTTPS connection. Instead, themes can be installed over an unencrypted connection, which could allow for a man-in-the-middle (MITM) attack by third parties replacing the theme content, which consists of images and toolbar text colors.

This issue only affects Firefox for Android. Firefox on other operating systems is not affected.