CVE-2026-2634: Spoofed web content presented under trusted domains using scripted navigation on Firefox iOS
Malicious scripts could cause desynchronization between the address bar and web content before a response is received in Firefox iOS, allowing attacker-controlled pages to be presented under spoofed domains.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Firefox for iOSto a version that resolves this vulnerability.Fixed in 147.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2634?
CVE-2026-2634 is classified as a high severity vulnerability affecting Firefox on iOS.
How do I fix CVE-2026-2634?
To mitigate CVE-2026-2634, update your Firefox app on iOS to the latest version.
What systems are affected by CVE-2026-2634?
CVE-2026-2634 affects Mozilla Firefox version 147.4 on Apple iOS devices.
What does CVE-2026-2634 exploit?
CVE-2026-2634 exploits scripted navigation to present spoofed web content under trusted domains.
What impact does CVE-2026-2634 have on users?
CVE-2026-2634 can lead to user confusion and potential phishing attacks due to desynchronized address bars and web content.