CVE-2026-2919

Received Received - Intake

UI Spoofing in Focus for iOS via Navigation Stall and Iframe Redirect

Publication date: 2026-03-09

Last updated on: 2026-05-06

Assigner: Mozilla Corporation

Description

Malicious scripts could display attacker-controlled web content under spoofed domains in Focus for iOS by stalling a _self navigation to an invalid port and triggering an iframe redirect, causing the UI to display a trusted domain without user interaction. This vulnerability was fixed in Focus for iOS 148.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-03-09

Last Modified

2026-05-06

Generated

2026-07-06

AI Q&A

2026-03-09

EPSS Evaluated

2026-07-05

NVD

CVE-2026-2919

EUVD

EUVD-2026-10338

Affected Vendors & Products

Vendor	Product	Version / Range
mozilla	firefox_focus	to 148.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-451	The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.

Attack-Flow Graph

Executive Summary

This vulnerability in Focus for iOS versions before 148.2 allows attacker-controlled web content to be displayed under spoofed domains. It happens by stalling a _self navigation to an invalid port and then triggering an iframe redirect. This causes the user interface to show a trusted domain without any user interaction, potentially misleading users.

Impact Analysis

[{'type': 'paragraph', 'content': "The vulnerability can mislead users into trusting malicious content because the browser UI displays a trusted domain even though the content is attacker-controlled. This can lead to phishing attacks, data theft, or other malicious activities by exploiting the user's trust in the displayed domain."}] [1]

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, you should update Focus for iOS to version 148.2 or later, where the issue has been fixed.

Hi! I’m here to help you understand CVE-2026-2919. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70