CVE-2025-10290: Opening links via the contextual menu in Focus for iOS would not update the toolbar UI correctly, allowing attackers to spoof websites
Published Sep 16, 2025
·Updated
Opening links via the contextual menu in Focus iOS for certain URL schemes would fail to load but would not refresh the toolbar correctly, allowing attackers to spoof websites if users were coerced into opening a link explicitly through a long-press
Affected Software
4 affected components
Focus Focus for iOS<143.0
All of the following
Mozilla Focus=143
Apple iOS
Mozilla Firefox Focus Iphone Os<143.0
Event History
Sep 16, 2025
CVE Published
via Mozilla·12:00 AM
Data Sourced
via Mozilla·12:00 AM
DescriptionSeverityAffected Software
CVE Published
via MITRE·12:26 PM
Data Sourced
via MITRE·12:26 PM
Description
Data Sourced
via NVD·01:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-10290?
CVE-2025-10290 is considered a high-severity vulnerability due to its potential to allow attackers to spoof websites.
2
How do I fix CVE-2025-10290?
To fix CVE-2025-10290, users should update Focus for iOS to version 143.1 or later.
3
Which versions of Focus for iOS are affected by CVE-2025-10290?
CVE-2025-10290 affects Focus for iOS versions up to 143.0.
4
What types of attacks can be conducted due to CVE-2025-10290?
Attackers can leverage CVE-2025-10290 to spoof websites by manipulating how links are opened through the contextual menu.
5
Is CVE-2025-10290 specific to any operating system?
Yes, CVE-2025-10290 is specific to Focus for iOS, which operates on the iOS platform.