James Lee

Name of the Vulnerable Software and Affected Versions: Firefox for iOS versions prior to 141 Description: The QR scanner component is susceptible to exploitation, potentially allowing malicious websites to be opened. This occurs when a user scans a specially crafted link utilizing Firefox's open-text URL scheme. Recommendations: Update Firefox for iOS to version 141 or later.

Name of the Vulnerable Software and Affected Versions: Firefox for iOS versions prior to 141 Description: The URL scheme used by Firefox to facilitate searching of text queries could incorrectly allow attackers to open arbitrary website URLs or internal pages if a user was tricked into clicking a link. Recommendations: Update Firefox for iOS to version 141 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox for iOS versions prior to 139 **Description** The issue allows attackers to spoof website addresses when opening maliciously-crafted URLs in Firefox from other apps, such as Safari, if the URLs utilize non-HTTP schemes used internally by the Firefox iOS client. **Recommendations** For Firefox for iOS versions prior to 139, update to version 139 or later to resolve the issue. As a temporary workaround, consider avoiding the use of non-HTTP schemes in URLs when opening them from other apps. Restrict access to potentially malicious URLs to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Focus versions prior to 138 **Description** Websites could leverage the truncating behavior of long URLs in the location view to potentially trick users into thinking they were on a different webpage. **Recommendations** For versions prior to 138, update to version 138 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 134 **Description** When using an invalid protocol scheme, an attacker could spoof the address bar. This issue only affects Android operating systems, while other operating systems are unaffected. **Recommendations** For Firefox versions prior to 134, update to version 134 or later to resolve the issue. As a temporary workaround, consider restricting the use of invalid protocol schemes to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Firefox for iOS versions prior to 133 Description: Accessing a non-secure HTTP site that uses a non-existent port may cause the SSL padlock icon in the location URL bar to appear secure misleadingly. Recommendations: For Firefox for iOS versions prior to 133, update to a version 133 or later to resolve the issue. As a temporary workaround, consider avoiding access to non-secure HTTP sites that use non-existent ports until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Focus for iOS versions prior to 132 **Description** The issue allows internal links to utilize the app scheme used for deeplinking, potentially circumventing some URL safety checks. This could result in link spoofing. **Recommendations** For Focus for iOS versions prior to 132, update to version 132 or later to resolve the issue. As a temporary workaround, consider restricting internal links from utilizing the app scheme used for deeplinking until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 132 Firefox ESR versions prior to 128.4 Firefox ESR versions prior to 115.17 Thunderbird versions prior to 128.4 Thunderbird versions prior to 132 **Description** A permission leak could occur from a trusted site to an untrusted site via `embed` or `object` elements. This issue is related to incorrect permission preservation. Exploitation of this issue may allow a remote attacker to impact the confidentiality of protected information. **Recommendations** For Firefox versions prior to 132, update to version 132 or later. For Firefox ESR versions prior to 128.4, update to version 128.4 or later. For Firefox ESR versions prior to 115.17, update to version 115.17 or later. For Thunderbird versions prior to 128.4, update to version 128.4 or later. For Thunderbird versions prior to 132, update to version 132 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 131 Firefox Focus for Android versions prior to 131 **Description** A user who enables full-screen mode on a specially crafted web page could potentially be prevented from exiting full screen mode. This may allow spoofing of other sites as the address bar is no longer visible. **Recommendations** For Firefox versions prior to 131, update to version 131 or later to resolve the issue. For Firefox Focus for Android versions prior to 131, update to version 131 or later to resolve the issue. As a temporary workaround, consider disabling full-screen mode on specially crafted web pages until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 130 **Description** The issue is related to the notification announcing the transition to fullscreen mode in Firefox on Android. Multiple prompts and panels from both Firefox and the Android OS could be used to obscure this notification, potentially leading to spoofing of the browser UI if the user is distracted by the sudden appearance of a prompt. The notifications now use the Android Toast feature. This issue only affects Firefox on Android, with other operating systems being unaffected. **Recommendations** For versions prior to 130, update to Firefox version 130 or later to resolve the issue. As a temporary workaround, consider being cautious when multiple prompts appear, ensuring to notice any visual transitions to fullscreen mode. Restricting the use of fullscreen mode until the update can also minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Focus for iOS versions prior to 130 Description: Websites could utilize Javascript links to spoof URL addresses in the Focus navigation bar. Recommendations: For Focus for iOS versions prior to 130, update to version 130 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Firefox for iOS versions prior to 129 **Description** A potential issue exists where long pressing on a download link could provide a means for cross-site scripting. **Recommendations** For Firefox for iOS versions prior to 129, update to version 129 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Firefox for iOS versions prior to 129 **Description** The contextual menu for links in Firefox for iOS could provide an opportunity for cross-site scripting attacks. **Recommendations** For Firefox for iOS versions prior to 129, update to version 129 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Firefox for iOS versions prior to 129 **Description** A potential issue exists where long pressing on a download link could allow Javascript commands to be executed within the browser. **Recommendations** For Firefox for iOS versions prior to 129, update to version 129 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Focus for iOS versions prior to 126 Description: The issue is related to the file scheme of URLs being hidden, potentially allowing spoofing of a website's address in the location bar. This could enable a remote attacker to conduct spoofing attacks by exploiting errors in the representation of information in the user interface. Recommendations: For Focus for iOS versions prior to 126, update to version 126 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Microsoft Bing Search (affected versions not specified) Description: The issue is related to a data protection mechanism flaw in the Microsoft Bing Search system for the iOS operating system. This can be exploited by a remote attacker to conduct spoofing attacks. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 123.0.6312.58 **Description** The issue is related to inappropriate implementation in iOS, allowing a remote attacker to leak cross-origin data via a crafted HTML page. This is due to insufficient access control, which can be exploited by a remote attacker to gain unauthorized access to protected information. The estimated number of potentially affected devices worldwide is not specified. **Recommendations** For Google Chrome versions prior to 123.0.6312.58, update to version 123.0.6312.58 or later to resolve the issue. As a temporary workaround, consider restricting access to potentially vulnerable HTML pages until the update is applied. Avoid using Google Chrome for sensitive operations until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** tvOS versions prior to 17.4 macOS Sonoma versions prior to 14.4 visionOS versions prior to 1.1 iOS versions prior to 17.4 iPadOS versions prior to 17.4 watchOS versions prior to 10.4 Safari versions prior to 17.4 **Description** The issue was addressed with improved UI handling. A malicious website may exfiltrate audio data cross-origin. **Recommendations** For tvOS versions prior to 17.4, update to tvOS 17.4 to resolve the issue. For macOS Sonoma versions prior to 14.4, update to macOS Sonoma 14.4 to resolve the issue. For visionOS versions prior to 1.1, update to visionOS 1.1 to resolve the issue. For iOS versions prior to 17.4, update to iOS 17.4 to resolve the issue. For iPadOS versions prior to 17.4, update to iPadOS 17.4 to resolve the issue. For watchOS versions prior to 10.4, update to watchOS 10.4 to resolve the issue. For Safari versions prior to 17.4, update to Safari 17.4 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Focus for iOS versions prior to 123 **Description** This issue allows an attacker to conduct a Universal Cross-Site Scripting (UXSS) attack on a victim website using a 302 redirect, provided the victim has a link to the attacker's website. **Recommendations** For Focus for iOS versions prior to 123, update to version 123 or later to resolve the issue. As a temporary workaround, consider restricting links to untrusted websites to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Firefox for iOS versions prior to 123 **Description** An issue allows an attacker to execute unauthorized scripts on the current top origin sites in the URL bar when a JavaScript URI is scanned with the QR code scanner. **Recommendations** For Firefox for iOS versions prior to 123, update to version 123 or later to resolve the issue.