What is the CVSS score of CVE-2026-2634?

CVE-2026-2634 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Apple are affected by CVE-2026-2634?

A critical vulnerability in Firefox iOS allows attackers to spoof legitimate domains and present malicious content to users, potentially enabling credential theft, phishing attacks, and data…

How to fix or mitigate CVE-2026-2634?

Within 24 hours: Issue security alert to all staff using Firefox iOS, advising against business-critical transactions on affected versions and recommending Chrome/Safari as temporary alternatives. Within 7 days: Inventory all Firefox iOS deployments across organization; disable iOS Firefox in Mobile Device Management (MDM) if business-critical usage detected. Within 30 days: Monitor for patch release (v147.4 or later); deploy immediately upon availability through MDM; re-enable Firefox only after patch confirmation.

Apple CVE-2026-2634

CRITICAL

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-02-24 security@mozilla.org

Apple Mozilla Information Disclosure

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 24, 2026 - 14:16 nvd

CRITICAL 9.8

DescriptionCVE.org

Malicious scripts could cause desynchronization between the address bar and web content before a response is received in Firefox iOS, allowing attacker-controlled pages to be presented under spoofed domains. This vulnerability affects Firefox for iOS < 147.4.

AnalysisAI

Address bar spoofing in Firefox before 148 allows malicious scripts to desynchronize the displayed URL from actual web content before receiving a response, enabling phishing attacks.