CVE-2024-1563

CVE-2024-1563 affects Mozilla Firefox for iOS Focus prior to version 122. The issue is a timeout race condition involving opening an external URL with a custom Firefox scheme, allowing an attacker to run unauthorized scripts on the top-origin page via a JavaScript URI. Connected documents confirm...

CVE-2024-26284

Focus for iOS is affected by a UXSS vulnerability that can be triggered via a 302 redirect if a victim site links to the attacker’s site. The issue is described for all Focus for iOS versions prior to 123, with remediation implemented in Focus for iOS 123 and later. The root cause involves improp...

CVE-2022-26485

CVE-2022-26485 is a Mozilla/firefox-family use-after-free vulnerability triggered by removing an XSLT parameter during processing. Affected products include Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus

CVE-2022-26486

CVE-2022-26486 describes a use-after-free in the WebGPU IPC framework leading to a sandbox escape. Affected products and versions (per connected docs): Firefox < 97.0.2; Firefox ESR < 91.6.1; Firefox for Android < 97.3.0; Thunderbird < 91.6.2; Focus

CVE-2023-6870

CVE-2023-6870 affects Firefox on Android (Android Firefox/Focus) and is triggered by applications that spawn a Toast notification in a background thread, potentially obscuring the fullscreen notification used by Firefox. The issue is tied to Android UI prompts and could lead to spoofing of the br...

CVE-2023-25743

The provided documents confirm CVE-2023-25743 affects Firefox Focus and describes a vulnerability where there is a lack of in-app notification when entering fullscreen mode. This could allow a malicious website to spoof the browser chrome. The root cause is the missing fullscreen notification in ...

CVE-2023-29546

CVE-2023-29546 affects Firefox for Android (and Focus for Android) with

CVE-2023-29534

CVE-2023-29534 affects Firefox for Android and Focus for Android, with versions earlier than 112 at risk. The issue stems from multiple techniques used to obscure the fullscreen notification, which could lead to user confusion and spoofing. The connected documents indicate the vulnerability is li...

CVE-2026-8945

Mozilla Firefox and Firefox Focus for Android versions prior to 151.0 are vulnerable to a sandbox escape issue. This security flaw allows an attacker to bypass security restrictions and violate data protection mechanisms, potentially compromising the confidentiality, integrity, and accessibility ...

CVE-2024-5022

The Mozilla Focus browser for iOS devices versions prior to 126 is vulnerable to a spoofing attack. The root cause is an error in the file scheme for hiding URLs and information representation within the user interface. A remote attacker can exploit this vulnerability to spoof a website's address...

CVE-2024-10474

Mozilla Focus for iOS versions prior to 132 are vulnerable to a security flaw where internal links can incorrectly utilize the app scheme intended for deeplinking . This allows for potential link spoofing by circumventing certain URL safety checks. To resolve this issue, users should update to ve...

CVE-2025-3859

Summary: CVE-2025-3859 affects Mozilla Firefox Focus for iOS (pre-138 builds). The vulnerability arises from a long URL truncation/eliding behavior in the address/location bar, which can mislead users into thinking they are on a different webpage. This is tied to the Firefox Focus/iOS truncation ...

CVE-2024-0606

CVE-2024-0606 affects Mozilla Focus for iOS before version 122. The issue is a UXSS vulnerability where an attacker can execute unauthorized scripts on a legitimate site by opening a javascript: URI via window.open(), leading to unauthorized actions within the user’s loaded webpage. Connected sou...

CVE-2024-8399

The CVE-2024-8399 issue affects Mozilla Focus for iOS prior to version 130, where Javascript links could spoof the navigation bar URL. Root cause: improper handling of Javascript links in the Focus navigation UI. Impact: spoofed URL addresses in the navigation bar; no broader system compromise st...

CVE-2024-0605

The CVE-2024-0605 issue affects Mozilla Focus for iOS prior to version 122. A race condition arises when using a javascript: URI with setTimeout, enabling an attacker to run unauthorized scripts on top-origin sites via the URL bar, potentially leading to arbitrary code execution or unauthorized a...

CVE-2025-55031

This vulnerability affects Firefox for iOS and Focus for iOS versions prior to 142 . Malicious pages can exploit the browser to pass FIDO: links to the OS, triggering the hybrid passkey transport . An attacker within Bluetooth range could leverage this to trick a user into using their passkey to ...

CVE-2026-2919

Mozilla Firefox Focus for iOS versions prior to 148.2 are vulnerable to a security flaw where malicious scripts can display attacker-controlled web content under spoofed domains. The root cause involves stalling a _self navigation to an invalid port and triggering an iframe redirect , which trick...

CVE-2025-55033

Mozilla Focus for iOS versions prior to 142 are vulnerable to a Cross-Site Scripting (XSS) vulnerability. The flaw occurs when a user drags JavaScript links to the URL bar, which can be exploited by an attacker to execute arbitrary web scripts or HTML via a crafted payload. This vulnerability was...

CVE-2025-55032

Mozilla Focus for iOS versions prior to 142 are vulnerable to a cross-site scripting (XSS) flaw caused by the improper handling of the Content-Disposition header. Specifically, the browser fails to respect headers of type Attachment , causing it to incorrectly display the content inline. An attac...

CVE-2025-10290

The Mozilla Focus for iOS browser is vulnerable to a spoofing vulnerability in its address bar component . When a user opens a link via the contextual menu using certain URL schemes, the page may fail to load, but the toolbar fails to refresh correctly. This allows an attacker to spoof websites i...