Firefox for iOS EUVD-2026-110067

Exploitation requires that the victim is using Firefox for iOS (not the default Safari) and visits an attacker-controlled web page that triggers a FaceTime call prompt into which arbitrary text can be injected; user interaction with that prompt is required (UI:R). Limiting factors: there is no code execution or data theft - the impact is confined to displaying misleading/phishing text inside the system FaceTime prompt (CWE-451), success depends on the user being deceived by the spoofed content, and the flaw is fully remediated by updating to Firefox for iOS 156.1. The precise mechanism by which the page inserts text into the prompt is not described in the available sources.

This is a low-to-moderate real-world risk best characterized as a user-interface spoofing issue rather than a memory-safety or code-execution flaw (CWE-451, UI misrepresentation). The input CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U) indicates a network-reachable, low-complexity attack by an unauthenticated attacker (PR:N) that requires user interaction (UI:R), which is consistent with a malicious web page tricking a user into viewing a spoofed FaceTime prompt. The signals are internally consistent and all point low: EPSS is 0.21% (11th percentile), SSVC reports Exploitation: none, Automatable: no, Technical Impact: partial, and the issue is not on the CISA KEV list. The vuln.today priority is 'this_month,' i.e., a routine-patch cadence rather than act_now/emergency. One notable inconsistency: the supplied CVSS impact metrics list C:L and A:L with I:N, which is counter-intuitive for a spoofing/phishing-text-injection flaw - a misrepresentation bug normally produces an integrity (I) impact and little to no confidentiality or availability impact, so those impact sub-metrics appear questionable and are worth verifying with the vendor. Overall this is a genuine but modest issue: realistic harm depends entirely on social-engineering success, not on technical compromise of the device.

An attacker hosts a malicious web page and lures a Firefox for iOS user to it; the page triggers a FaceTime call prompt and injects attacker-controlled text so the system-level prompt displays a convincing phishing message (for example, a fake 'verify your account' instruction). The user, trusting the native iOS UI, is deceived into following the attacker's instructions. No public exploit identified at time of analysis, so this remains a plausible social-engineering vector rather than an observed campaign.