Renwa Hiwa

**Name of the Vulnerable Software and Affected Versions** Focus for iOS versions prior to 151.3.1 Klar for iOS versions prior to 151.3.1 **Description** Universal Cross-Site Scripting (UXSS) exists in the Webkit navigation of Focus for iOS and Klar for iOS. UXSS is a security flaw that allows an attacker to execute malicious scripts across different origins, bypassing the Same-Origin Policy (SOP), which is a critical security mechanism that prevents websites from interacting with data from other websites. **Recommendations** Update Focus for iOS to version 151.3.1. Update Klar for iOS to version 151.3.1.

**Name of the Vulnerable Software and Affected Versions** Focus for iOS versions prior to 148.2 **Description** A security issue exists in Focus for iOS that could allow malicious scripts to display attacker-controlled web content under spoofed domains. This is achieved by stalling a navigation to an invalid port, which then triggers an iframe redirect. This results in the user interface displaying a trusted domain without any user interaction. **Recommendations** Update Focus for iOS to version 148.2 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 137 Firefox ESR versions prior to 128.9 Thunderbird versions prior to 137 Thunderbird ESR versions prior to 128.9 **Description** A crafted URL containing specific Unicode characters could hide the true origin of the page, resulting in a potential spoofing attack. **Recommendations** For Firefox versions prior to 137, update to version 137 or later. For Firefox ESR versions prior to 128.9, update to version 128.9 or later. For Thunderbird versions prior to 137, update to version 137 or later. For Thunderbird ESR versions prior to 128.9, update to version 128.9 or later.

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 133 Firefox ESR versions prior to 128.5 Thunderbird versions prior to 133 Thunderbird versions prior to 128.5 Description: The issue is related to incorrect restriction of visualized user interface layers in Mozilla Firefox, Firefox ESR, and the Thunderbird email client. A crafted URL containing Arabic script and whitespace characters could hide the true origin of the page, resulting in a potential spoofing attack. This could allow a remote attacker to conduct spoofing attacks. Recommendations: For Firefox versions prior to 133, update to version 133 or later to resolve the issue. For Firefox ESR versions prior to 128.5, update to version 128.5 or later to resolve the issue. For Thunderbird versions prior to 133, update to version 133 or later to resolve the issue. For Thunderbird versions prior to 128.5, update to version 128.5 or later to resolve the issue. As a temporary workaround, consider restricting access to URLs containing Arabic script and whitespace characters to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Google Chrome for iOS versions prior to 147.0.7727.55 **Description** An incorrect security user interface issue in the Omnibox (the browser's address bar) allows a remote attacker to spoof the contents of the URL bar. This is achieved by using a specially crafted domain name, specifically utilizing two Right-to-Left (RTL) Arabic character subdomains to mislead the user. **Recommendations** Update Google Chrome for iOS to version 147.0.7727.55 or later.