Egyptian security researcher Mohamed A. Baset is "guilty" of discovering this flaw, which seems to be a variation (but it's not) of CVE-2014-8346, a security vulnerability that affected the Samsung Find My Mobile service.

For that vulnerability, also revealed by Mr. Baset, the National Institute of Standards and Technology gave a CSVV (Common Vulnerability Scoring System) score of 7.8 out of 10, but got a 10 for exploitability, meaning it was quite easy to carry out, without too many technical skills being needed by an attacker.

According to Mr. Baset's findings, by loading the Firefox Find My Device website inside a hidden iframe on other sites, via basic clickjacking techniques, a hacker would have been able to carry out attacks that would lock or unlock the phone's screen, set a new PIN only known by the attacker, or make the phone ring at maximum volume for one minute, even if set in vibrate or silent mode.

While these actions seem more like bad pranks, they would allow criminals who stole phones to craft a Web interface through which they could unlock PIN-protected phones with the push of a button.