Desynchronization Vulnerability in Firefox for iOS by Mozilla
CVE-2026-2634

9.8CRITICAL

Key Information:

Vendor

Mozilla
Status
Firefox For iOS
Vendor
CVE Published:
24 February 2026

What is CVE-2026-2634?

A vulnerability in Firefox for iOS enables malicious scripts to create a mismatch between the address bar and web content prior to receiving a response. This allows attackers to present harmful content under deceptive domains, potentially misleading users and compromising their data security. The affected versions include all iterations of Firefox for iOS prior to 147.4.

Affected Version(s)

Firefox for iOS < 147.4

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1975529
https://www.mozilla.org/security/advisories/mfsa2026-12/

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Renwa
.