Malicious websites can issue a server‑side redirect to an internal error page, causing the address bar to display a spoofed URL. The attacker is subsequently able to lure users into believing they are accessing a legitimate site, which could lead to credential theft or other social‑engineering attacks. The vulnerability is an open redirect (CWE‑601) and does not provide direct code execution or denial of service, but it enables phishing and deceptive UI behavior.

Mozilla Firefox for iOS is affected, specifically all releases prior to version 136. The issue was addressed and fixed in Firefox for iOS 136, so any device running an older build on iPhone OS is vulnerable. Apple’s iOS platform itself is not the direct target, but the browsers on iOS devices are.

The CVSS score of 5.4 indicates a moderate severity, and the EPSS is below 1%, suggesting a low probability of widespread exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Attackers would typically need to trick a user into visiting a malicious webpage that performs the redirect; the spoofed URL trick is visible to the user, so detection is possible but not guaranteed. Because the flaw involves a server‑side redirect, exploitation requires an attacker‑controlled website and victim browsing behavior.