CVE-2026-2032: Interrupted page loads in new tabs could allow website spoofing under trusted domains in Firefox iOS
Published Feb 9, 2026
·Updated
Malicious scripts that interrupt new tab page loading could cause desynchronization between the address bar and page content, allowing the attacker to spoof arbitrary HTML under a trusted domain.
Affected Software
3 affected components
All of the following
Mozilla Firefox=147.2.1
Apple iOS
Mozilla Firefox Iphone Os<147.2.1
Event History
Feb 9, 2026
CVE Published
via Mozilla·12:00 AM
Data Sourced
via Mozilla·12:00 AM
DescriptionSeverityAffected Software
Feb 16, 2026
CVE Published
via MITRE·02:13 PM
Data Sourced
via MITRE·02:13 PM
Description
Data Sourced
via NVD·03:18 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-2032?
The severity of CVE-2026-2032 is classified as high due to the potential for website spoofing under trusted domains.
2
How do I fix CVE-2026-2032?
To fix CVE-2026-2032, users should update Firefox for iOS to the latest version that addresses this vulnerability.
3
What platforms are affected by CVE-2026-2032?
CVE-2026-2032 affects Firefox version 147.2.1 running on Apple iOS.
4
What kind of attack does CVE-2026-2032 enable?
CVE-2026-2032 enables malicious scripts to spoof arbitrary HTML in the address bar during interrupted page loads.
5
Is there any user impact due to CVE-2026-2032?
Yes, users may unintentionally interact with spoofed content that appears to be from trusted domains due to CVE-2026-2032.