CVE-2026-2919
Received Received - Intake
UI Spoofing in Focus for iOS via Navigation Stall and Iframe Redirect

Publication date: 2026-03-09

Last updated on: 2026-05-06

Assigner: Mozilla Corporation

Description
Malicious scripts could display attacker-controlled web content under spoofed domains in Focus for iOS by stalling a _self navigation to an invalid port and triggering an iframe redirect, causing the UI to display a trusted domain without user interaction. This vulnerability was fixed in Focus for iOS 148.2.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-09
Last Modified
2026-05-06
Generated
2026-06-16
AI Q&A
2026-03-09
EPSS Evaluated
2026-06-15
NVD
CVE-2026-2919
EUVD
EUVD-2026-10338
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
mozilla firefox_focus to 148.2 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-451 The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability in Focus for iOS versions before 148.2 allows attacker-controlled web content to be displayed under spoofed domains. It happens by stalling a _self navigation to an invalid port and then triggering an iframe redirect. This causes the user interface to show a trusted domain without any user interaction, potentially misleading users.

Impact Analysis

[{'type': 'paragraph', 'content': "The vulnerability can mislead users into trusting malicious content because the browser UI displays a trusted domain even though the content is attacker-controlled. This can lead to phishing attacks, data theft, or other malicious activities by exploiting the user's trust in the displayed domain."}] [1]

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, you should update Focus for iOS to version 148.2 or later, where the issue has been fixed.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-2919. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart