CVE-2026-2634 — User Interface (UI) Misrepresentation of Critical Information in Mozilla Firefox
Severity
9.8CRITICALNVD
EPSS
0.1%
top 80.61%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedFeb 24
Description
Malicious scripts could cause desynchronization between the address bar and web content before a response is received in Firefox iOS, allowing attacker-controlled pages to be presented under spoofed domains. This vulnerability was fixed in Firefox for iOS 147.4.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9
Affected Packages1 packages
🔴Vulnerability Details
3OSV▶
CVE-2026-2634: Malicious scripts could cause desynchronization between the address bar and web content before a response is received in Firefox iOS, allowing attacke↗2026-02-24
CVEList▶
Spoofed web content presented under trusted domains using scripted navigation on Firefox iOS↗2026-02-24
GHSA▶
GHSA-gwgg-r543-4wvw: Malicious scripts could cause desynchronization between the address bar and web content before a response is received in Firefox iOS, allowing attacke↗2026-02-24