Firefox for iOS downloads can display misleading file names when a Unicode right‑to‑left override character is present in an URL or web page, allowing a malicious site to trick a user into saving a file of an unintended type. The consequence is that a user may unknowingly download a file that is different from what the URL indicates, potentially exposing the device to content that is misclassified by the operating system and could lead to confusion or exploitation if the file type is malicious. The flaw was addressed in Firefox for iOS 144.0.

Mozilla Firefox for iOS, with all versions prior to 144.0 affected. Updating to 144.0 or newer removes the vulnerability; any older builds leave the download UI susceptible to filename spoofing via Unicode right‑to‑left override characters.

The CVSS score of 6.5 indicates a moderate severity, and the EPSS score of less than 1% suggests a low probability of active exploitation at this time. The vulnerability is not listed in CISA KEV. An attacker would need to host a web page or deliver content containing targeted Unicode characters, a scenario that could arise from any website with user‑generated content. The attack vector is dissemination from a malicious site and relies on the user engaging with the download interface. Given the moderate score and low exploitation likelihood, the risk is considered limited but tangible, especially for users who do not update their browser promptly.