Firefox Focus (Mozilla) - vulnerabilities (CVEs)

20 CVEs, 0 in the last 30 days, 47 known versions, newest CVE from 2026-05-19. Vendor: Mozilla.

CVEs of Firefox Focus

CVE-2026-8945 - CVSS 7.5 (high), 2026-05-19: Sandbox escape in Firefox and Firefox Focus for Android. This vulnerability was fixed in Firefox 151.
CVE-2026-2919 - CVSS 4.3 (medium), 2026-03-09: Malicious scripts could display attacker-controlled web content under spoofed domains in Focus for iOS by stalling a _self navigation to an invalid port and…
CVE-2025-10290 - CVSS 6.5 (medium), 2025-09-16: Opening links via the contextual menu in Focus iOS for certain URL schemes would fail to load but would not refresh the toolbar correctly, allowing attackers…
CVE-2025-55032 - CVSS 6.1 (medium), 2025-08-19: Focus for iOS would not respect a Content-Disposition header of type Attachment and would incorrectly display the content inline, potentially allowing for XSS…
CVE-2025-55031 - CVSS 9.8 (critical), 2025-08-19: Malicious pages could use Firefox for iOS to pass FIDO: links to the OS and trigger the hybrid passkey transport. An attacker within Bluetooth range could…
CVE-2025-55033 - CVSS 6.1 (medium), 2025-08-19: Dragging JavaScript links to the URL bar in Focus for iOS could be utilized to run malicious scripts, potentially resulting in XSS attacks. This vulnerability…
CVE-2025-3859 - CVSS 6.1 (medium), 2025-04-30: Websites directing users to long URLs that caused eliding to occur in the location view could leverage the truncating behavior to potentially trick users into…
CVE-2024-10474 - CVSS 9.1 (critical), 2024-10-29: Focus was incorrectly allowing internal links to utilize the app scheme used for deeplinking, which could result in links potentially circumventing some URL…
CVE-2024-8399 - CVSS 4.7 (medium), 2024-09-03: Websites could utilize Javascript links to spoof URL addresses in the Focus navigation bar This vulnerability affects Focus for iOS < 130.
CVE-2024-5022 - CVSS 4.4 (medium), 2024-05-17: The file scheme of URLs would be hidden, resulting in potential spoofing of a website's address in the location bar This vulnerability affects Focus for iOS <…
CVE-2024-26284 - CVSS 6.1 (medium), 2024-02-22: Utilizing a 302 redirect, an attacker could have conducted a Universal Cross-Site Scripting (UXSS) on a victim website, if the victim had a link to the…
CVE-2024-1563 - CVSS 8.1 (high), 2024-02-22: An attacker could have executed unauthorized scripts on top origin sites using a JavaScript URI when opening an external URL with a custom Firefox scheme and…
CVE-2024-0605 - CVSS 7.5 (high), 2024-01-22: Using a javascript: URI with a setTimeout race condition, an attacker can execute unauthorized scripts on top origin sites in urlbar. This bypasses security…
CVE-2024-0606 - CVSS 6.1 (medium), 2024-01-22: An attacker could execute unauthorized script on a legitimate site through UXSS using window.open() by opening a javascript URI leading to unauthorized…
CVE-2023-6870 - CVSS 4.3 (medium), 2023-12-19: Applications which spawn a Toast notification in a background thread may have obscured fullscreen notifications displayed by Firefox. *This issue only affects…
CVE-2023-29546 - CVSS 6.5 (medium), 2023-06-19: When recording the screen while in Private Browsing on Firefox for Android the address bar and keyboard were not hidden, potentially leaking sensitive…
CVE-2023-29534 - CVSS 9.1 (critical), 2023-06-19: Different techniques existed to obscure the fullscreen notification in Firefox and Focus for Android. These could have led to potential user confusion and…
CVE-2023-25743 - CVSS 7.5 (high), 2023-06-02: A lack of in app notification for entering fullscreen mode could have lead to a malicious website spoofing browser chrome.<br>*This bug only affects Firefox…
CVE-2022-26486 - CVSS 9.6 (critical), 2022-12-22: An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild…
CVE-2022-26485 - CVSS 8.8 (high), 2022-12-22: Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw.…