CVE-2025-10290

Opening links via the contextual menu in Focus iOS for certain URL schemes would fail to load but would not refresh the toolbar correctly, allowing attackers to spoof websites if users were coerced into opening a link explicitly through a long-press. This vulnerability was fixed in Focus for iOS 143.0.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://bugzilla.mozilla.org/show_bug.cgi?id=1975566	Issue Tracking Permissions Required
https://www.mozilla.org/security/advisories/mfsa2025-76/	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:mozilla:firefox_focus:*:*:*:*:*:iphone_os:*:*

History

23 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Abrir enlaces a través del menú contextual en Focus para iOS para ciertos esquemas de URL no se cargarían pero no actualizarían la barra de herramientas correctamente, permitiendo a los atacantes suplantar sitios web si los usuarios fueran coaccionados a abrir un enlace explícitamente mediante una pulsación larga. Esta vulnerabilidad afecta a Focus para iOS anterior a 143.0.

Information

Published : 2025-09-16 13:15

Updated : 2026-10-23 22:10

NVD link : CVE-2025-10290

Mitre link : CVE-2025-10290

CVE.ORG link : CVE-2025-10290

JSON object : View

Products Affected

mozilla

firefox_focus

CWE

CWE-451

User Interface (UI) Misrepresentation of Critical Information

{"id": "CVE-2025-10290", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10290", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-16T17:30:14.447776Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@mozilla.org", "affectedData": [{"vendor": "Mozilla", "product": "Focus for iOS", "versions": [{"status": "unaffected", "version": "143.0", "versionType": "rpm", "lessThanOrEqual": "*"}]}]}], "published": "2025-09-16T13:15:41.520", "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1975566", "tags": ["Issue Tracking", "Permissions Required"], "source": "security@mozilla.org"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-76/", "tags": ["Vendor Advisory"], "source": "security@mozilla.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-451"}]}], "descriptions": [{"lang": "en", "value": "Opening links via the contextual menu in Focus iOS for certain URL schemes would fail to load but would not refresh the toolbar correctly, allowing attackers to spoof websites if users were coerced into opening a link explicitly through a long-press. This vulnerability was fixed in Focus for iOS 143.0."}, {"lang": "es", "value": "Abrir enlaces a trav\u00e9s del men\u00fa contextual en Focus para iOS para ciertos esquemas de URL no se cargar\u00edan pero no actualizar\u00edan la barra de herramientas correctamente, permitiendo a los atacantes suplantar sitios web si los usuarios fueran coaccionados a abrir un enlace expl\u00edcitamente mediante una pulsaci\u00f3n larga. Esta vulnerabilidad afecta a Focus para iOS anterior a 143.0."}], "lastModified": "2026-10-23T22:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox_focus:*:*:*:*:*:iphone_os:*:*", "vulnerable": true, "matchCriteriaId": "F0689DCB-CA40-4BEA-945D-D74C7351ED2D", "versionEndExcluding": "143.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@mozilla.org"}