CVE-2026-2919 Attacker-controlled content shown under spoofed domains in Focus for iOS via stalled navigation and iframe redirect

Malicious scripts could display attacker-controlled web content under spoofed domains in Focus for iOS by stalling a self navigation to an invalid port and triggering an iframe redirect, causing the UI to display a trusted domain without user interaction. This vulnerability was fixed in Focus for...

CVE-2026-2919

Mozilla Firefox Focus for iOS versions prior to 148.2 are vulnerable to a security flaw where malicious scripts can display attacker-controlled web content under spoofed domains. The root cause involves stalling a _self navigation to an invalid port and triggering an iframe redirect , which trick...

CVE-2026-2919 Attacker-controlled content shown under spoofed domains in Focus for iOS via stalled navigation and iframe redirect

Malicious scripts could display attacker-controlled web content under spoofed domains in Focus for iOS by stalling a self navigation to an invalid port and triggering an iframe redirect, causing the UI to display a trusted domain without user interaction. This vulnerability was fixed in Focus for...

PT-2026-21830

Name of the Vulnerable Software and Affected Versions Focus for iOS versions prior to 148.2 Description A security issue exists in Focus for iOS that could allow malicious scripts to display attacker-controlled web content under spoofed domains. This is achieved by stalling a navigation to an...