CVE-2026-2919: Attacker-controlled content shown under spoofed domains in Focus for iOS via stalled navigation and iframe redirect

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-09 · updated 2026-06-17
Weakness: CWE-451

Description

Malicious scripts could display attacker-controlled web content under spoofed domains in Focus for iOS by stalling a _self navigation to an invalid port and triggering an iframe redirect, causing the UI to display a trusted domain without user interaction. This vulnerability was fixed in Focus for iOS 148.2.

Affected products

Mozilla Focus for iOS: before 148.2 — fixed in 148.2

How to fix

Upgrade to a fixed version: Mozilla Focus for iOS 148.2. Check the vendor advisory for mitigations.

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1975842
https://www.mozilla.org/security/advisories/mfsa2026-18/

Get alerted when CVE-2026-2919 or the next vulnerability affects your stack