Firefox Focus
CVE-2024-26284
MEDIUM
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
Utilizing a 302 redirect, an attacker could have conducted a Universal Cross-Site Scripting (UXSS) on a victim website, if the victim had a link to the attacker's website. This vulnerability affects Focus for iOS < 123.
AnalysisAI
Utilizing a 302 redirect, an attacker could have conducted a Universal Cross-Site Scripting (UXSS) on a victim website, if the victim had a link to the attacker's website. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Technical ContextAI
This vulnerability is classified as Cross-Site Scripting (XSS) (CWE-79), which allows attackers to inject malicious scripts into web pages viewed by other users. Utilizing a 302 redirect, an attacker could have conducted a Universal Cross-Site Scripting (UXSS) on a victim website, if the victim had a link to the attacker's website. This vulnerability affects Focus for iOS < 123. Affected products include: Mozilla Firefox Focus.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Sanitize all user input, use Content-Security-Policy headers, encode output contextually (HTML, JS, URL). Use frameworks with built-in XSS protection.
More in Firefox Focus
View allRemoving an XSLT parameter during processing could have lead to an exploitable use-after-free. Rated high severity (CVSS
An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. Rated c
Different techniques existed to obscure the fullscreen notification in Firefox and Focus for Android. Rated critical sev
An attacker could have executed unauthorized scripts on top origin sites using a JavaScript URI when opening an external
Using a javascript: URI with a setTimeout race condition, an attacker can execute unauthorized scripts on top origin sit
A lack of in app notification for entering fullscreen mode could have lead to a malicious website spoofing browser chrom
When recording the screen while in Private Browsing on Firefox for Android the address bar and keyboard were not hidden,
Opening links via the contextual menu in Focus iOS for certain URL schemes would fail to load but would not refresh the
Focus was incorrectly allowing internal links to utilize the app scheme used for deeplinking, which could result in link
Websites directing users to long URLs that caused eliding to occur in the location view could leverage the truncating be
Focus for iOS would not respect a Content-Disposition header of type Attachment and would incorrectly display the conten
Dragging JavaScript links to the URL bar in Focus for iOS could be utilized to run malicious scripts, potentially result
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today