CVE-2026-2634: Malicious scripts could cause desynchronization between the address bar and web content before a response is received in Firefox iOS, allowing…

critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

Malicious scripts could cause desynchronization between the address bar and web content before a response is received in Firefox iOS, allowing attacker-controlled pages to be presented under spoofed domains. This vulnerability was fixed in Firefox for iOS 147.4.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
debian	firefox	—	—
mozilla	firefox	< 147.4	147.4
mozilla	firefox	—	—

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

osv9.8CRITICAL