CVE-2026-2634

A malicious script can trigger a desynchronization state between the browser's address bar and the loaded web content at the moment when the server response has not yet been received. This allows the attacker to display their own controlled page while showing a trusted, fake domain in the address bar. This mechanism falls into the CWE-451 category, which involves errors that mislead the user about the source of presented information.

An attacker can effectively impersonate trusted web services (e.g., banks, login portals), phishing authentication credentials or other sensitive information from users who are unable to distinguish a fake page from a real one based on the address bar.

Firefox for iOS should be updated to version 147.4 or later, in which the vulnerability has been fixed. The update is available through the Apple App Store.

Mozilla Firefox for iOS in versions prior to 147.4