Mozilla Focus vulnerabilities

• mozilla focus, focus for ios, klar +1 more +3 more UXSS in Focus for iOS / Klar Webkit navigation CVE-2026-11799 7.5 HighJune 9, 2026
• mozilla firefox, firefox focus, red hat enterprise linux 10 +4 more +6 more Sandbox escape in Firefox and Firefox Focus for Android CVE-2026-8945 7.5 HighMay 19, 2026
• mozilla focus for ios, firefox focus +1 more Attacker-controlled content shown under spoofed domains in Focus for iOS via stalled navigation and iframe redirect CVE-2026-2919 4.3 MediumMarch 9, 2026
• mozilla focus for ios, firefox focus +1 more Opening links via the contextual menu in Focus for iOS would not update the toolbar UI correctly, allowing attackers to spoof websites CVE-2025-10290 6.5 MediumSeptember 16, 2025
• mozilla focus for ios, firefox focus +1 more Drag and drop gestures in Focus for iOS could allow JavaScript links to be executed incorrectly CVE-2025-55033 6.1 MediumAugust 19, 2025
• mozilla focus for ios, firefox focus +1 more Focus incorrectly ignores Content-Disposition headers for some MIME types CVE-2025-55032 6.1 MediumAugust 19, 2025
• mozilla firefox, firefox for ios, focus for ios +1 more +3 more Passkey phishing within Bluetooth range CVE-2025-55031 9.8 CriticalAugust 19, 2025
• mozilla firefox focus, focus +1 more Firefox Focus elide URL allows address bar spoofing CVE-2025-3859 6.1 MediumApril 30, 2025
• mozilla focus for ios, firefox focus +1 more Focus was incorrectly allowing internal links to utilize the app scheme used for deeplinking,... CVE-2024-10474 6.5 MediumOctober 29, 2024
• mozilla focus for ios, firefox focus +1 more Websites could utilize Javascript links to spoof URL addresses in the Focus navigation bar This... CVE-2024-8399 4.7 MediumSeptember 3, 2024
• mozilla focus for ios, firefox focus +1 more The file scheme of URLs would be hidden, resulting in potential spoofing of a website's address... CVE-2024-5022 4.4 MediumMay 17, 2024
• mozilla focus for ios, firefox focus +1 more Utilizing a 302 redirect, an attacker could have conducted a Universal Cross-Site Scripting (UXSS... CVE-2024-26284 6.1 MediumFebruary 22, 2024
• mozilla focus for ios, firefox focus +1 more An attacker could have executed unauthorized scripts on top origin sites using a JavaScript URI... CVE-2024-1563 8.1 HighFebruary 22, 2024
• mozilla focus for ios, firefox focus +1 more An attacker could execute unauthorized script on a legitimate site through UXSS using window.open... CVE-2024-0606 6.1 MediumJanuary 22, 2024
• mozilla focus for ios, firefox focus +1 more Using a javascript: URI with a setTimeout race condition, an attacker can execute unauthorized... CVE-2024-0605 7.5 HighJanuary 22, 2024
• mozilla firefox, firefox focus +1 more Applications which spawn a Toast notification in a background thread may have obscured fullscreen... CVE-2023-6870 4.3 MediumDecember 19, 2023
• mozilla firefox for android, focus for android, firefox focus +1 more +3 more When recording the screen while in Private Browsing on Firefox for Android the address bar and... CVE-2023-29546 6.5 MediumJune 19, 2023
• mozilla firefox for android, focus for android, firefox focus +1 more +3 more Different techniques existed to obscure the fullscreen notification in Firefox and Focus for... CVE-2023-29534 9.1 CriticalJune 19, 2023
• mozilla firefox, firefox for android, focus +2 more +4 more Mozilla developers Randell Jesup, Andrew McCreight, Gabriele Svelto, and the Mozilla Fuzzing Team... CVE-2023-29551 Fix available 8.8 HighApril 12, 2023
• mozilla firefox, firefox for android, focus +2 more +4 more Under certain circumstances, a call to the <code>bind</code> function may have resulted in the... CVE-2023-29549 Fix available 6.5 MediumApril 12, 2023
• mozilla firefox, firefox for android, focus +2 more +4 more When a secure cookie existed in the Firefox cookie jar an insecure cookie for the same domain... CVE-2023-29547 Fix available 6.5 MediumApril 12, 2023
• mozilla firefox, firefox for android, focus +2 more +4 more If multiple instances of resource exhaustion occurred at the incorrect time, the garbage... CVE-2023-29544 Fix available 6.5 MediumApril 12, 2023
• mozilla firefox, firefox for android, focus +2 more +4 more An attacker could have caused memory corruption and a potentially exploitable use-after-free of a... CVE-2023-29543 Fix available 8.8 HighApril 12, 2023
• mozilla firefox, firefox for android, focus +2 more +4 more Using a redirect embedded into <code>sourceMappingUrls</code> could allow for navigation to... CVE-2023-29540 Fix available 6.1 MediumApril 12, 2023
• mozilla firefox, firefox for android, focus +2 more +4 more Under specific circumstances a WebExtension may have received a <code>jar:file:///</code> URI... CVE-2023-29538 Fix available 4.3 MediumApril 12, 2023
• mozilla firefox, firefox for android, focus +2 more +4 more Multiple race conditions in the font initialization could have led to memory corruption and... CVE-2023-29537 Fix available 7.5 HighApril 12, 2023
• mozilla firefox, firefox esr, firefox for android +4 more +6 more Mozilla developers Randell Jesup, Andrew Osmond, Sebastian Hengst, Andrew McCreight, and the... CVE-2023-29550 Fix available 8.8 HighApril 11, 2023
• mozilla firefox, firefox esr, firefox for android +4 more +6 more A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result.... CVE-2023-29548 Fix available 6.5 MediumApril 11, 2023
• mozilla firefox, firefox esr, firefox for android +4 more +6 more Firefox did not properly handle downloads of files ending in <code>.desktop</code>, which can be... CVE-2023-29541 Fix available 8.8 HighApril 11, 2023
• mozilla firefox, firefox esr, firefox for android +4 more +6 more When handling the filename directive in the Content-Disposition header, the filename would be... CVE-2023-29539 Fix available 8.8 HighApril 11, 2023
• mozilla firefox, firefox esr, firefox for android +4 more +6 more An attacker could cause the memory manager to incorrectly free a pointer that addresses attacker... CVE-2023-29536 Fix available 8.8 HighApril 11, 2023
• mozilla firefox, firefox esr, firefox for android +4 more +6 more Following a Garbage Collector compaction, weak maps may have been accessed before they were... CVE-2023-29535 Fix available 6.5 MediumApril 11, 2023
• mozilla firefox, firefox esr, firefox for android +4 more +6 more A website could have obscured the fullscreen notification by using a combination of <code>window... CVE-2023-29533 Fix available 4.3 MediumApril 11, 2023
• mozilla firefox, firefox esr, firefox focus +2 more A lack of in app notification for entering fullscreen mode could have lead to a malicious website... CVE-2023-25743 7.5 HighFebruary 20, 2023
• mozilla firefox, firefox esr, firefox for android +4 more +6 more An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable... CVE-2022-26486 In KEVFix available 9.6 CriticalMarch 6, 2022
• mozilla firefox, firefox esr, firefox for android +4 more +6 more Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We... CVE-2022-26485 In KEVPublic exploitFix available EPSS 14.3% 8.8 HighMarch 6, 2022