Security & bug reports

Report privately

Security vulnerabilities, signature mismatches or a suspicious download: report privately through GitHub private vulnerability reporting. Please do not open a public issue for these. The process, and the turnaround for urgent Gecko security releases, are in SECURITY.md.

If an APK’s signing certificate does not show the SHA-256 digest below, do not install it, and include the sha256 of the file you have in the report.

64:14:EB:33:46:81:CF:6E:92:90:34:B5:6A:06:2D:2B:8D:A0:90:82:21:72:F7:A3:95:2C:85:FD:D1:28:3B:D0

Other bugs

• Bugs in Gecko or Firefox for Android itself belong with Mozilla (Bugzilla); the issue form asks whether stock Firefox shows the same problem.
• Everything else: open an issue using the Android bug form. Triage is described in TRIAGE.md.
• Please do not report Redoubt problems to LibreWolf: they did not build it and cannot fix it.