CVE-2026-2032 — User Interface (UI) Misrepresentation of Critical Information in Mozilla Firefox
Severity
4.3MEDIUMNVD
EPSS
0.0%
top 90.50%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedFeb 16
Description
Malicious scripts that interrupt new tab page loading could cause desynchronization between the address bar and page content, allowing the attacker to spoof arbitrary HTML under a trusted domain. This vulnerability was fixed in Firefox for iOS 147.2.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4
Affected Packages1 packages
🔴Vulnerability Details
3CVEList▶
Interrupted page loads in new tabs could allow website spoofing under trusted domains in Firefox iOS↗2026-02-16
GHSA▶
GHSA-jwv5-943c-f5wh: Malicious scripts that interrupt new tab page loading could cause desynchronization between the address bar and page content, allowing the attacker to↗2026-02-16
OSV▶
CVE-2026-2032: Malicious scripts that interrupt new tab page loading could cause desynchronization between the address bar and page content, allowing the attacker to↗2026-02-16