CVE-2026-2634 Spoofed web content presented under trusted domains using scripted navigation on Firefox iOS

Malicious scripts could cause desynchronization between the address bar and web content before a response is received in Firefox iOS, allowing attacker-controlled pages to be presented under spoofed domains. This vulnerability was fixed in Firefox for iOS 147.4...

CVE-2026-2634

CVE-2026-2634 : The vulnerability affects Firefox for iOS prior to version 147.4, where malicious scripts can desynchronize the address bar from web content before a response is received, allowing attacker-controlled pages to be shown under spoofed domains. The connected documents provide the sam...

PT-2026-21830

Malicious scripts could display attacker-controlled web content under spoofed domains in Focus for iOS by stalling a self navigation to an invalid port and triggering an iframe redirect, causing the UI to display a trusted domain without user interaction. This vulnerability affects Focus for iOS...