CVE-2024-0606: Mozilla Firefox Focus

Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days.

An attacker could execute unauthorized script on a legitimate site through UXSS using window.open() by opening a javascript URI leading to unauthorized actions within the user's loaded webpage. This vulnerability affects Focus for iOS < 122.

Affected products

• Mozilla Firefox Focus: before 122.0 (fixed in 122.0)

Published 2024-01-22. Last modified 2026-06-17.