Mozilla Focus for iOS

• CVE-2026-11799 High 7.5 UXSS in Focus for iOS / Klar Webkit navigation 0.2%
• CVE-2026-2919 Medium 4.3 Attacker-controlled content shown under spoofed domains in Focus for iOS via stalled navigation and iframe redirect 0.2%
• CVE-2025-10290 Medium 6.5 Opening links via the contextual menu in Focus for iOS would not update the toolbar UI correctly, allowing attackers to spoof websites 0.3%
• CVE-2025-55033 Medium 6.1 Drag and drop gestures in Focus for iOS could allow JavaScript links to be executed incorrectly 0.2%
• CVE-2025-55032 Medium 6.1 Focus incorrectly ignores Content-Disposition headers for some MIME types 0.2%
• CVE-2025-55031 Critical 9.8 Passkey phishing within Bluetooth range 0.4%
• CVE-2024-10474 Critical 9.1 Focus was incorrectly allowing internal links to utilize the app scheme used for deeplinking, which could result in links potentially circumventing some URL safety checks This vulnerability affects Fo 0.3%
• CVE-2024-8399 Medium 4.7 Websites could utilize Javascript links to spoof URL addresses in the Focus navigation bar This vulnerability affects Focus for iOS < 130. 0.3%
• CVE-2024-5022 Medium 4.4 The file scheme of URLs would be hidden, resulting in potential spoofing of a website's address in the location bar This vulnerability affects Focus for iOS < 126. 0.1%
• CVE-2024-1563 High 8.1 An attacker could have executed unauthorized scripts on top origin sites using a JavaScript URI when opening an external URL with a custom Firefox scheme and a timeout race condition. This vulnerabili 0.4%
• CVE-2024-26284 Medium 6.1 Utilizing a 302 redirect, an attacker could have conducted a Universal Cross-Site Scripting (UXSS) on a victim website, if the victim had a link to the attacker's website. This vulnerability affects F 0.3%
• CVE-2024-0606 Medium 6.1 An attacker could execute unauthorized script on a legitimate site through UXSS using window.open() by opening a javascript URI leading to unauthorized actions within the user's loaded webpage. This v 0.3%
• CVE-2024-0605 High 7.5 Using a javascript: URI with a setTimeout race condition, an attacker can execute unauthorized scripts on top origin sites in urlbar. This bypasses security measures, potentially leading to arbitrary 0.4%