CVE-2025-55033

Published: Aug 19, 2025Modified: Jun 17, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Dragging JavaScript links to the URL bar in Focus for iOS could be utilized to run malicious scripts, potentially resulting in XSS attacks. This vulnerability was fixed in Focus for iOS 142.

Affected (1)

Products: Mozilla: Firefox Focus

Mozilla

1 product

Firefox Focus

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox Focus	Before 142.0

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://bugzilla.mozilla.org/show_bug.cgi?id=1913825

Source: security@mozilla.org

Issue TrackingPermissions Required

https://www.mozilla.org/security/advisories/mfsa2025-69/

Source: security@mozilla.org

Vendor Advisory

Timeline

No history available yet.