CVE-2026-2634: Spoofed web content presented under trusted domains using scripted navigation on Firefox iOS
Published Feb 20, 2026
·Updated
Malicious scripts could cause desynchronization between the address bar and web content before a response is received in Firefox iOS, allowing attacker-controlled pages to be presented under spoofed domains.
Affected Software
3 affected components
All of the following
Mozilla Firefox=147.4
Apple iOS
Mozilla Firefox Iphone Os<147.4
Event History
Feb 20, 2026
CVE Published
via Mozilla·12:00 AM
Data Sourced
via Mozilla·12:00 AM
DescriptionSeverityAffected Software
Feb 24, 2026
CVE Published
via MITRE·01:33 PM
Data Sourced
via MITRE·01:33 PM
Description
Data Sourced
via NVD·02:16 PM
DescriptionSeverityWeaknessAffected Software
Jan 4, 58137
Event
via FIRST·07:03 PM
Frequently Asked Questions
1
What is the severity of CVE-2026-2634?
CVE-2026-2634 is classified as a high severity vulnerability affecting Firefox on iOS.
2
How do I fix CVE-2026-2634?
To mitigate CVE-2026-2634, update your Firefox app on iOS to the latest version.
3
What systems are affected by CVE-2026-2634?
CVE-2026-2634 affects Mozilla Firefox version 147.4 on Apple iOS devices.
4
What does CVE-2026-2634 exploit?
CVE-2026-2634 exploits scripted navigation to present spoofed web content under trusted domains.
5
What impact does CVE-2026-2634 have on users?
CVE-2026-2634 can lead to user confusion and potential phishing attacks due to desynchronized address bars and web content.