CVE-2024-0605

7.5 highEPSS 0.4%

Using a javascript: URI with a setTimeout race condition, an attacker can execute unauthorized scripts on top origin sites in urlbar. This bypasses security measures, potentially leading to arbitrary code execution or unauthorized actions within the user's loaded webpage. This vulnerability affects Focus for iOS < 122.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 32% of CVEs (scores of 2026-10-31)
CWE: CWE-362
Published: 2024-01-22
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

mozilla:firefox_focus

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1855575
https://www.mozilla.org/security/advisories/mfsa2024-03/
https://bugzilla.mozilla.org/show_bug.cgi?id=1855575
https://www.mozilla.org/security/advisories/mfsa2024-03/

Check your stack JSON