CVE-2026-2919: Mozilla Firefox Focus

Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days.

Malicious scripts could display attacker-controlled web content under spoofed domains in Focus for iOS by stalling a _self navigation to an invalid port and triggering an iframe redirect, causing the UI to display a trusted domain without user interaction. This vulnerability was fixed in Focus for iOS 148.2.

Affected products

• Mozilla Firefox Focus: before 148.2 (fixed in 148.2)

Published 2026-03-09. Last modified 2026-06-17.