Vulnerability

CERT-In Vulnerability Note CIVN-2026-0129
Domain Spoofing Vulnerability in Firefox Focus for iOS

Original Issue Date:March 11, 2026

Severity Rating: MEDIUM

Software Affected

Mozilla Firefox Focus for iOS versions prior to 148.2

Overview

A domain spoofing vulnerability has been identified in Mozilla Firefox Focus for iOS, which could allow malicious content to be displayed under spoofed trusted domains.

Target Audience:
All organizations and administrators using Mozilla Firefox Focus for iOS.

Risk Assessment:
Medium risk of domain spoofing that may mislead users into trusting malicious content.

Impact Assessment:
Potential for display of attacker-controlled content under a spoofed domain, which could facilitate phishing attacks and disclosure of sensitive information.

Description

A domain spoofing vulnerability has been reported in Mozilla Firefox Focus for iOS due to improper handling of navigation events combined with iframe redirection. An attacker could exploit this vulnerability by crafting malicious web content that stalls navigation to an invalid port and subsequently triggers an iframe redirect.

Successful exploitation of this vulnerability may allow an attacker to deceive users by presenting malicious content under a trusted domain name, thereby increasing the likelihood of phishing or other social engineering attacks.

Solution

Apply appropriate updates as mentioned by the vendor:
https://www.mozilla.org/en-US/security/advisories/mfsa2026-18/

Vendor Information

Mozilla
https://www.mozilla.org

References

https://www.mozilla.org/en-US/security/advisories/mfsa2026-18/

CVE Name
CVE-2026-2919

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-22902657

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India