A user can scan a QR code that contains a website URL and the Firefox for iOS browser will open the link without presenting the usual confirmation alert. The flaw allows an attacker to deliver malicious content or phishing pages directly through a QR code, bypassing the user’s guardrail. Based on the description, it is inferred that the attacker’s primary vector is a crafted QR code presented to a victim who is using Firefox on iOS, resulting in the automatic opening of a potentially harmful website. The vulnerability involves a weakness in the browser’s confirmation logic rather than a traditional authentication bypass.

Vendors affected are Mozilla for the Firefox for iOS product. The fix was supplied in Firefox for iOS version 136, so all earlier releases are vulnerable. The issue manifests on iOS devices running the Firefox app.

The CVSS score of 4.3 indicates a medium severity, and the EPSS score of less than 1% shows exploitation is considered low probability. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to supply a crafted QR code to a user who scans it using Firefox on iOS; no network‑level access or additional credentials are required to trigger the bypass.