Under certain circumstances the user opt‑in setting that requires authentication before using Firefox Focus could be bypassed, allowing the application to be accessed without its intended authentication mechanism. The weakness is classified as CWE‑288: Improper Authentication. Using the app in this way could expose private browsing sessions or location data that were meant to be protected by the lock screen setting.

Mozilla Firefox Focus for Android. Versions up to but not including 134 are vulnerable. The fix is applied in Firefox 134 and later.

The CVSS score of 3.3 indicates a low severity issue, and the EPSS score is reported as less than 1 %, suggesting a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation would presumably require the attacker to be in possession of the device and to trigger the specific circumstances that allow the authentication bypass; it is not a remote or network‑based attack. As such, the overall risk remains low.