Mozilla Focus for iOS
13 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-11799 | corrigé en 151.3.1 | UXSS in Focus for iOS / Klar Webkit navigation | HIGH 7.5 | 0.2 % | ||
| CVE-2026-2919 | corrigé en 148.2 | Attacker-controlled content shown under spoofed domains in Focus for iOS via stalled navigation and iframe redirect | MEDIUM 4.3 | 0.2 % | ||
| CVE-2025-10290 | corrigé en 143.0 | Opening links via the contextual menu in Focus for iOS would not update the toolbar UI correctly, allowing attackers to spoof websites | MEDIUM 6.5 | 0.3 % | ||
| CVE-2025-55033 | corrigé en 142 | Drag and drop gestures in Focus for iOS could allow JavaScript links to be executed incorrectly | MEDIUM 6.1 | 0.2 % | ||
| CVE-2025-55032 | corrigé en 142 | Focus incorrectly ignores Content-Disposition headers for some MIME types | MEDIUM 6.1 | 0.2 % | ||
| CVE-2025-55031 | corrigé en 142 | Passkey phishing within Bluetooth range | CRITICAL 9.8 | 0.4 % | ||
| CVE-2024-10474 | unspecified – < 132 | Focus was incorrectly allowing internal links to utilize the app scheme used for deeplinking, which could result in links potentially circum | CRITICAL 9.1 | 0.3 % | ||
| CVE-2024-8399 | unspecified – < 130 | Websites could utilize Javascript links to spoof URL addresses in the Focus navigation bar This vulnerability affects Focus for iOS < 130. | MEDIUM 4.7 | 0.3 % | ||
| CVE-2024-5022 | unspecified – < 126 | The file scheme of URLs would be hidden, resulting in potential spoofing of a website's address in the location bar This vulnerability affec | MEDIUM 4.4 | 0.1 % | ||
| CVE-2024-26284 | unspecified – < 123 | Utilizing a 302 redirect, an attacker could have conducted a Universal Cross-Site Scripting (UXSS) on a victim website, if the victim had a | MEDIUM 6.1 | 0.3 % | ||
| CVE-2024-1563 | unspecified – < 122 | An attacker could have executed unauthorized scripts on top origin sites using a JavaScript URI when opening an external URL with a custom F | HIGH 8.1 | 0.4 % | ||
| CVE-2024-0606 | unspecified – < 122 | An attacker could execute unauthorized script on a legitimate site through UXSS using window.open() by opening a javascript URI leading to u | MEDIUM 6.1 | 0.3 % | ||
| CVE-2024-0605 | unspecified – < 122 | Using a javascript: URI with a setTimeout race condition, an attacker can execute unauthorized scripts on top origin sites in urlbar. This b | HIGH 7.5 | 0.4 % |