CVE-2026-2634: Spoofed web content presented under trusted domains using scripted navigation on Firefox iOS

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-02-24 · updated 2026-06-17
Weakness: CWE-451

Description

Malicious scripts could cause desynchronization between the address bar and web content before a response is received in Firefox iOS, allowing attacker-controlled pages to be presented under spoofed domains. This vulnerability was fixed in Firefox for iOS 147.4.

Affected products

Mozilla Firefox: before 147.4 — fixed in 147.4

How to fix

Upgrade to a fixed version: Mozilla Firefox 147.4. Check the vendor advisory for mitigations.

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1975529
https://www.mozilla.org/security/advisories/mfsa2026-12/

Get alerted when CVE-2026-2634 or the next vulnerability affects your stack