What is the CVSS score of EUVD-2026-41972?

EUVD-2026-41972 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Firefox for iOS EUVD-2026-41972

| CVE-2026-13356 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-07-07 security@mozilla.org

GHSA-66fv-p34j-fwgr

Information Disclosure Apple Mozilla

6.3

CVSS 3.1 · Vendor: mozilla

Severity by source

Vendor (mozilla) PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

Network-delivered UI spoofing requiring active user navigation; no availability impact applies to address bar deception; C:L and I:L reflect phishing-grade credential and content integrity risk.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mozilla).

CVSS VectorVendor: mozilla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 07, 2026 - 14:28 vuln.today

CVSS changed

Jul 07, 2026 - 14:22 NVD

6.3 (MEDIUM)

CVE Published

Jul 07, 2026 - 00:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 07, 2026 - 00:16 cve.org

MEDIUM 6.3

DescriptionCVE.org

A malicious webpage could interrupt a pending navigation by enqueuing a synchronous JavaScript dialog, causing the browser UI to display the destination origin in the address bar while continuing to render attacker-controlled content. This vulnerability was fixed in Firefox for iOS 152.3.

AnalysisAI

Address bar spoofing in Firefox for iOS allows a remote unauthenticated attacker to display a trusted origin in the browser's address bar while the victim views and interacts with fully attacker-controlled content - a classic and effective phishing enabler. The attack exploits a race condition in navigation handling: a malicious page enqueues a synchronous JavaScript dialog at the moment a user navigates away, freezing the address bar on the destination's legitimate origin while the malicious page's content continues to render. No public exploit code has been identified and EPSS is 0.15% (4th percentile), indicating no observed widespread exploitation; however, the technique is conceptually simple and phishing value is high.

Technical ContextAI

CWE-451 (User Interface Misrepresentation of Critical Information) describes failures where the UI presents security-critical state - here, the current origin - in a way that can be made inaccurate. Firefox for iOS relies on the browser chrome (address bar) to communicate trust context to users, a fundamental Web security assumption. The vulnerability arises because synchronous JavaScript dialogs (window.alert, window.confirm, window.prompt) can interrupt the browser's navigation pipeline on iOS. When a pending navigation is in flight and such a dialog is enqueued by the still-active malicious page, Firefox for iOS fails to reconcile its visual address bar state with the actual rendered document origin, displaying the destination origin prematurely while still serving attacker-controlled markup. No CPE string was provided in the intelligence feed, but the affected product is Mozilla Firefox for iOS (distinct from Firefox on Android or desktop platforms) running on Apple iOS devices, fixed in version 152.3.

RemediationAI

Update Firefox for iOS to version 152.3 or later via the Apple App Store; this is the vendor-released patch confirmed in Mozilla Security Advisory MFSA2026-65 (https://www.mozilla.org/security/advisories/mfsa2026-65/). No workaround fully mitigates the vulnerability short of patching, because the flaw is in the browser's core navigation and dialog handling logic. As a compensating control while patching, users can disable JavaScript on untrusted sites via Firefox for iOS's per-site settings, which prevents synchronous dialog enqueuing - however, this breaks broad website functionality and is not suitable as a general posture. Organizations managing iOS fleets via MDM can enforce browser version compliance policies to ensure 152.3 is deployed promptly.