CVE-2026-2032
published 2026-02-16CVE-2026-2032: Malicious scripts that interrupt new tab page loading could cause desynchronization between the address bar and page content, allowing the attacker to spoof…
PriorityP419medium4.3CVSS 3.1
AVNACLPRNUIRSUCLINAN
EPSS
0.18%
7.1th percentile
Malicious scripts that interrupt new tab page loading could cause desynchronization between the address bar and page content, allowing the attacker to spoof arbitrary HTML under a trusted domain. This vulnerability was fixed in Firefox for iOS 147.2.1.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | firefox | — | — |
| mozilla | firefox | < 147.2.1 | 147.2.1 |
| mozilla | firefox | — | — |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
osv4.3MEDIUM
vendor_redhat5.5MEDIUM
vendor_debian4.3LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length
vendor_redhat·2026-08-22·CVSS 5.5
CVE-2026-74694 [MEDIUM] CWE-125 kernel: net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length
kernel: net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length
In the Linux kernel, the following vulnerability has been resolved:
net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length
ncsi_send_cmd_nl() takes the number of bytes to copy from the
attacker-controlled ncsi_pkt_hdr.length field of the in-band packet
header, while the source buffer is the NCSI_ATTR_DATA netlink
attribute whose readable size is nla_len() - sizeof(ncsi_pkt_hdr).
The two length sources are never cross-checked: only
nla_len() >= sizeof(struct ncsi_pkt_hdr) is enforced.
With hdr->length set larger than the attribute payload (up to 65535
against at most 2032 readable bytes), ncsi_cmd_handler_oem() copies
past the end of the netlink attribute buffer with unsafe_memcpy(),
leaking up to ~64KB of ker
Debian
CVE-2026-2032: firefox - Malicious scripts that interrupt new tab page loading could cause desynchronizat...
vendor_debian·2026·CVSS 4.3
CVE-2026-2032 [MEDIUM] CVE-2026-2032: firefox - Malicious scripts that interrupt new tab page loading could cause desynchronizat...
Malicious scripts that interrupt new tab page loading could cause desynchronization between the address bar and page content, allowing the attacker to spoof arbitrary HTML under a trusted domain. This vulnerability affects Firefox for iOS < 147.2.1.
Scope: local
sid: resolved
Mozilla
Mozilla Foundation Security Advisory 2026-09: CVE-2026-2032
vendor_mozilla·CVSS 4.3
CVE-2026-2032 [MEDIUM] Mozilla Foundation Security Advisory 2026-09: CVE-2026-2032
Mozilla Foundation Security Advisory 2026-09
CVE: CVE-2026-2032
Product: Firefox for iOS
Impact: high
Fixed in: Firefox for iOS 147.2.1
GHSA
GHSA-jwv5-943c-f5wh: Malicious scripts that interrupt new tab page loading could cause desynchronization between the address bar and page content, allowing the attacker to
ghsa_unreviewed·2026-02-16
CVE-2026-2032 [MEDIUM] CWE-290 GHSA-jwv5-943c-f5wh: Malicious scripts that interrupt new tab page loading could cause desynchronization between the address bar and page content, allowing the attacker to
Malicious scripts that interrupt new tab page loading could cause desynchronization between the address bar and page content, allowing the attacker to spoof arbitrary HTML under a trusted domain. This vulnerability affects Firefox for iOS < 147.2.1.
OSV
CVE-2026-2032: Malicious scripts that interrupt new tab page loading could cause desynchronization between the address bar and page content, allowing the attacker to
osv·2026-02-16·CVSS 4.3
CVE-2026-2032 [MEDIUM] CVE-2026-2032: Malicious scripts that interrupt new tab page loading could cause desynchronization between the address bar and page content, allowing the attacker to
Malicious scripts that interrupt new tab page loading could cause desynchronization between the address bar and page content, allowing the attacker to spoof arbitrary HTML under a trusted domain. This vulnerability affects Firefox for iOS < 147.2.1.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-74694 kernel: net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length
bugzilla·2026-08-22
CVE-2026-74694 [MEDIUM] CVE-2026-74694 kernel: net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length
CVE-2026-74694 kernel: net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length
In the Linux kernel, the following vulnerability has been resolved:
net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length
ncsi_send_cmd_nl() takes the number of bytes to copy from the
attacker-controlled ncsi_pkt_hdr.length field of the in-band packet
header, while the source buffer is the NCSI_ATTR_DATA netlink
attribute whose readable size is nla_len() - sizeof(ncsi_pkt_hdr).
The two length sources are never cross-checked: only
nla_len() >= sizeof(struct ncsi_pkt_hdr) is enforced.
With hdr->length set larger than the attribute payload (up to 65535
against at most 2032 readable bytes), ncsi_cmd_handler_oem() copies
past the end of the netlink attribute buffer with unsafe_memcpy(),
leaking
Bugzilla
Address Bar Spoofing via google.com/csi + about: Navigation on Firefox for iOS
bugzilla·2026-01-13
CVE-2026-2032 Address Bar Spoofing via google.com/csi + about: Navigation on Firefox for iOS
Address Bar Spoofing via google.com/csi + about: Navigation on Firefox for iOS
## Summary:
A UI spoofing issue exists in Firefox for iOS where an attacker-controlled page can open https://www.google.com/csi and subsequently inject attacker-controlled content while the address bar continues to display a trusted Google URL.
## Device:
iPhone 16 Pro 26.2 iOS Version
## User Agent:
Mozilla/5.0 (iPhone; CPU iPhone OS 26_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/147.0 Mobile/15E148 Safari/604.1
## Steps to reproduce:
1. Open Firefox for iOS & navigate to the provided PoC HTML file.
2. Click “Sign In to Google” & A new tab opens to https://www.google.com/csi.
3. After a short delay, attacker-controlled HTML is injected into the opened tab.
4. Observe that: The address
Wiz
CVE-2026-2032 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 4.3
CVE-2026-2032 [MEDIUM] CVE-2026-2032 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-2032 :
NixOS vulnerability analysis and mitigation
Malicious scripts that interrupt new tab page loading could cause desynchronization between the address bar and page content, allowing the attacker to spoof arbitrary HTML under a trusted domain. This vulnerability affects Firefox for iOS < 147.2.1.
Source : NVD
## 4.3
Score
Published February 16, 2026
Severity MEDIUM
CNA Score 4.3
Affected Technologies
NixOS
Mozilla Firefox
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 9.5
Exploitation Probability (EPSS) N/A
Affected packages and libraries
firefox
cpe:2.3:a:mozilla:firefox
Sources
Alpine 3.12, 3.13, 3.14, 3.15, 3.16, 3.17, 3.18, 3.19, 3.20, 3.21, 3.22, 3.23, edge
2026-02-16
Published