Malicious scripts could display attacker-controlled web content under spoofed domains in Focus for iOS by stalling a _self navigation to an invalid port and triggering…

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Mar 9, 2026 · NIST NVD

   Detected

   Malicious scripts could display attacker-controlled web content under spoofed domains in Focus for iOS by stalling a _self navigation to an invalid port and triggering an iframe redirect, causing the UI to display a trusted domain without user interaction. This vulnerability was fixed in Focus for iOS 148.2.

2. Jun 17, 2026 · NIST NVD

   Updated

   Malicious scripts could display attacker-controlled web content under spoofed domains in Focus for iOS by stalling a _self navigation to an invalid port and triggering an iframe redirect, causing the UI to display a trusted domain without user interaction. This vulnerability was fixed in Focus for iOS 148.2.

Affected

• cpe mozilla/firefox focusversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-2919

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-2919

  Malicious scripts could display attacker-controlled web content under spoofed domains in Focus for iOS by stalling a _self navigation to an invalid port and triggering an iframe redirect, causing the UI to display a trusted domain without user interaction. This vulnerability was

  nvd.nist.gov

References

• Permissions Required · bugzilla.mozilla.org
• Vendor Advisory · mozilla.org