What’s Vulnerable › Vulnerabilities

CVE-2024-0605

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-01-22 · updated 2026-06-17
• Weakness: CWE-362

Description

Using a javascript: URI with a setTimeout race condition, an attacker can execute unauthorized scripts on top origin sites in urlbar. This bypasses security measures, potentially leading to arbitrary code execution or unauthorized actions within the user's loaded webpage. This vulnerability affects Focus for iOS < 122.

Affected products

• Mozilla Focus for iOS: before 122.0 — fixed in 122.0

How to fix

Upgrade to a fixed version: Mozilla Focus for iOS 122.0. Check the vendor advisory for mitigations.

References

• https://bugzilla.mozilla.org/show_bug.cgi?id=1855575
• https://www.mozilla.org/security/advisories/mfsa2024-03/
• https://bugzilla.mozilla.org/show_bug.cgi?id=1855575
• https://www.mozilla.org/security/advisories/mfsa2024-03/

Get alerted when CVE-2024-0605 or the next vulnerability affects your stack