Firefox Focus
CVE-2026-2919
MEDIUM
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Malicious scripts could display attacker-controlled web content under spoofed domains in Focus for iOS by stalling a _self navigation to an invalid port and triggering an iframe redirect, causing the UI to display a trusted domain without user interaction. This vulnerability affects Focus for iOS < 148.2.
AnalysisAI
Domain spoofing in Focus for iOS versions prior to 148.2 allows remote attackers to display malicious content under trusted domain names through navigation stalling and iframe redirection techniques, without requiring user interaction beyond the initial page load. An attacker can leverage this to conduct phishing attacks or distribute misleading content by presenting spoofed trusted domains in the browser UI. No patch is currently available for this vulnerability.
Technical ContextAI
This vulnerability (CWE-451: User Interface (UI) Misrepresentation of Critical Information) Malicious scripts could display attacker-controlled web content under spoofed domains in Focus for iOS by stalling a _self navigation to an invalid port and triggering an iframe redirect, causing the UI to display a trusted domain without user interaction. This vulnerability affects Focus for iOS < 148.2.
RemediationAI
Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.
More in Firefox Focus
View allRemoving an XSLT parameter during processing could have lead to an exploitable use-after-free. Rated high severity (CVSS
An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. Rated c
Utilizing a 302 redirect, an attacker could have conducted a Universal Cross-Site Scripting (UXSS) on a victim website,
Different techniques existed to obscure the fullscreen notification in Firefox and Focus for Android. Rated critical sev
An attacker could have executed unauthorized scripts on top origin sites using a JavaScript URI when opening an external
Using a javascript: URI with a setTimeout race condition, an attacker can execute unauthorized scripts on top origin sit
A lack of in app notification for entering fullscreen mode could have lead to a malicious website spoofing browser chrom
When recording the screen while in Private Browsing on Firefox for Android the address bar and keyboard were not hidden,
Opening links via the contextual menu in Focus iOS for certain URL schemes would fail to load but would not refresh the
Focus was incorrectly allowing internal links to utilize the app scheme used for deeplinking, which could result in link
Websites directing users to long URLs that caused eliding to occur in the location view could leverage the truncating be
Focus for iOS would not respect a Content-Disposition header of type Attachment and would incorrectly display the conten
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today