Mozilla Focus for iOS
13 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-11799 | fixed in 151.3.1 | UXSS in Focus for iOS / Klar Webkit navigation | HIGH 7.5 | 0.2 % | ||
| CVE-2026-2919 | fixed in 148.2 | Attacker-controlled content shown under spoofed domains in Focus for iOS via stalled navigation and iframe redirect | MEDIUM 4.3 | 0.2 % | ||
| CVE-2025-10290 | fixed in 143.0 | Opening links via the contextual menu in Focus for iOS would not update the toolbar UI correctly, allowing attackers to spoof websites | MEDIUM 6.5 | 0.3 % | ||
| CVE-2025-55033 | fixed in 142 | Drag and drop gestures in Focus for iOS could allow JavaScript links to be executed incorrectly | MEDIUM 6.1 | 0.2 % | ||
| CVE-2025-55032 | fixed in 142 | Focus incorrectly ignores Content-Disposition headers for some MIME types | MEDIUM 6.1 | 0.2 % | ||
| CVE-2025-55031 | fixed in 142 | Passkey phishing within Bluetooth range | CRITICAL 9.8 | 0.4 % | ||
| CVE-2024-10474 | unspecified – < 132 | Focus was incorrectly allowing internal links to utilize the app scheme used for deeplinking, which could result in links potentially circum | CRITICAL 9.1 | 0.3 % | ||
| CVE-2024-8399 | unspecified – < 130 | Websites could utilize Javascript links to spoof URL addresses in the Focus navigation bar This vulnerability affects Focus for iOS < 130. | MEDIUM 4.7 | 0.3 % | ||
| CVE-2024-5022 | unspecified – < 126 | The file scheme of URLs would be hidden, resulting in potential spoofing of a website's address in the location bar This vulnerability affec | MEDIUM 4.4 | 0.1 % | ||
| CVE-2024-26284 | unspecified – < 123 | Utilizing a 302 redirect, an attacker could have conducted a Universal Cross-Site Scripting (UXSS) on a victim website, if the victim had a | MEDIUM 6.1 | 0.3 % | ||
| CVE-2024-1563 | unspecified – < 122 | An attacker could have executed unauthorized scripts on top origin sites using a JavaScript URI when opening an external URL with a custom F | HIGH 8.1 | 0.4 % | ||
| CVE-2024-0606 | unspecified – < 122 | An attacker could execute unauthorized script on a legitimate site through UXSS using window.open() by opening a javascript URI leading to u | MEDIUM 6.1 | 0.3 % | ||
| CVE-2024-0605 | unspecified – < 122 | Using a javascript: URI with a setTimeout race condition, an attacker can execute unauthorized scripts on top origin sites in urlbar. This b | HIGH 7.5 | 0.4 % |