Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 29

Export CSV
CVE-2025-14744

Filename spoofing via Unicode Right-to-Left Override in Firefox for iOS

Unicode RTLO characters could allow malicious websites to spoof filenames in the downloads UI for Firefox for iOS, potentially tricking users into saving files of an unexpected file type. This vulnerability was fixed in Firefox for iOS 144.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Apple Mozilla
Products
Ios Firefox Firefox For Ios
CVE-2025-54144

Internal Firefox open-text URL scheme allowed loading of arbitrary URLs

The URL scheme used by Firefox to facilitate searching of text queries could incorrectly allow attackers to open arbitrary website URLs or internal pages if a user was tricked into clicking a link. This vulnerability was fixed in Firefox for iOS 141.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Apple Mozilla
Products
Ios Firefox Firefox For Ios
CVE-2025-54145

Scanning a malicious URL utilizing Firefox's open-text scheme with the QR code scanner could load arbitrary websites

The QR scanner could allow arbitrary websites to be opened if a user was tricked into scanning a malicious link that leveraged Firefox's open-text URL scheme. This vulnerability was fixed in Firefox for iOS 141.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Apple Mozilla
Products
Ios Firefox Firefox For Ios
CVE-2025-55030

Content-Disposition headers incorrectly ignored for some MIME types

Firefox for iOS would not respect a Content-Disposition header of type Attachment and would incorrectly display the content inline rather than downloading, potentially allowing for XSS attacks. This vulnerability was fixed in Firefox for iOS 142.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Apple Mozilla
Products
Ios Firefox Firefox For Ios
CVE-2025-55028

JavaScript alerts could impede UI interaction or allow denial of service attacks

Malicious scripts utilizing repetitive JavaScript alerts could prevent client user interaction in some scenarios and allow for denial of service attacks. This vulnerability was fixed in Firefox for iOS 142.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Apple Mozilla
Products
Ios Firefox Firefox For Ios
CVE-2025-55031

Passkey phishing within Bluetooth range

Malicious pages could use Firefox for iOS to pass FIDO: links to the OS and trigger the hybrid passkey transport. An attacker within Bluetooth range could have used this to trick the user into using their passkey to log the attacker's computer into the target account. This vulnerability was fixed in Firefox for iOS 142 and Focus for iOS 142.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Apple Mozilla
Products
Ios Firefox Firefox Focus and 2 more
CVE-2025-55029

Malicious scripts could spam popups for denial of service attacks

Malicious scripts could bypass the popup blocker to spam new tabs, potentially resulting in denial of service attacks. This vulnerability was fixed in Firefox for iOS 142.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Apple Mozilla
Products
Ios Firefox Firefox For Ios
CVE-2026-2032

Interrupted page loads in new tabs could allow website spoofing under trusted domains in Firefox iOS

Malicious scripts that interrupt new tab page loading could cause desynchronization between the address bar and page content, allowing the attacker to spoof arbitrary HTML under a trusted domain. This vulnerability was fixed in Firefox for iOS 147.2.1.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox Firefox For Ios
CVE-2026-2634

Spoofed web content presented under trusted domains using scripted navigation on Firefox iOS

Malicious scripts could cause desynchronization between the address bar and web content before a response is received in Firefox iOS, allowing attacker-controlled pages to be presented under spoofed domains. This vulnerability was fixed in Firefox for iOS 147.4.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox Firefox For Ios