Firefox Focus vulnerabilities

6 known vulnerabilities in Firefox Focus from Mozilla. 6 are rated high or critical, and 2 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  Firefox for iOS: URL Redirection to Untrusted Site

  CVE-2025-55031Aug 19, 2025Mozilla

  Malicious pages could use Firefox for iOS to pass FIDO: links to the OS and trigger the hybrid passkey transport. An attacker within Bluetooth range could have used this to trick the user into using their passkey to log the attacker's computer into the target

• 8.1 High severity

  Focus for iOS: Time-of-check Time-of-use (TOCTOU) Race Condition

  CVE-2024-1563Feb 22, 2024Mozilla

  An attacker could have executed unauthorized scripts on top origin sites using a JavaScript URI when opening an external URL with a custom Firefox scheme and a timeout race condition. This vulnerability affects Focus for iOS < 122.

• 7.5 High severity

  Focus for iOS: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2024-0605Jan 22, 2024Mozilla

  Using a javascript: URI with a setTimeout race condition, an attacker can execute unauthorized scripts on top origin sites in urlbar. This bypasses security measures, potentially leading to arbitrary code execution or unauthorized actions within the user's loa

• 7.5 High severity

  Firefox: Authentication Bypass by Spoofing

  CVE-2023-25743Jun 2, 2023Mozilla

  A lack of in app notification for entering fullscreen mode could have lead to a malicious website spoofing browser chrome.<br>*This bug only affects Firefox Focus. Other versions of Firefox are unaffected.*. This vulnerability affects Firefox < 110 and Firefox

• 9.6 Critical severity

  Mozilla Firefox Use-After-Free Exploited

  CVE-2022-26486Dec 22, 2022MozillaEPSS 2.36%

  An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Androi

• 8.8 High severity

  Mozilla Firefox Use-After-Free Exploited

  CVE-2022-26485Dec 22, 2022MozillaEPSS 14.3%

  Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunde