Mozilla Foundation Security Advisory 2024-03

Security Vulnerabilities fixed in Focus for iOS 122

Announced

January 22, 2024

Impact

critical

Products

Focus for iOS

Fixed in

• Focus for iOS 122

#CVE-2024-0605: JavaScript URI running on top origin sites

Reporter

James Lee

Impact

critical

Description

Using a javascript: URI with a setTimeout race condition, an attacker can execute unauthorized scripts on top origin sites in urlbar. This bypasses security measures, potentially leading to arbitrary code execution or unauthorized actions within the user's loaded webpage.

References

• Bug 1855575

#CVE-2024-0606: UXSS attack with window.open()

Reporter

James Lee

Impact

high

Description

An attacker could execute unauthorized script on a legitimate site through UXSS using window.open() by opening a javascript URI leading to unauthorized actions within the user's loaded webpage.

References

• Bug 1855030