CVE-2024-1563

2024-02-2215:15:08

[email protected]

web.nvd.nist.gov

2259

cve-2024-1563

unauthorized scripts

javascript uri

custom firefox scheme

timeout race condition

focus for ios

6.6 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

8.7%

JSON

An attacker could have executed unauthorized scripts on top origin sites using a JavaScript URI when opening an external URL with a custom Firefox scheme and a timeout race condition. This vulnerability affects Focus for iOS < 122.

VendorProductVersionCPE
mozillafocus*cpe:2.3:a:mozilla:focus:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
mozilla	focus	*	cpe:2.3:a:mozilla:focus::::::::

References

bugzilla.mozilla.org/show_bug.cgi?id=1863831

www.mozilla.org/security/advisories/mfsa2024-09/