The vulnerability allows maliciously crafted URLs that use non-HTTP schemes to be opened in Firefox for iOS from other applications such as Safari. By leveraging these internal schemes, an attacker can trick users into seeing a forged website address. Based on the description, it is inferred that such spoofing could be used for phishing or social‑engineering, although this is not explicitly stated. This flaw is classified under CWE‑939 and affects the trust model of the URL bar and the user’s perception of site authenticity.

Mozilla Firefox for iOS versions prior to 139 are impacted. The security fix was included in the 139 release and later versions. Users of older builds should verify their application version to determine if the issue remains present.

The CVSS score of 4.3 denotes moderate risk, while an EPSS score of < 1 % indicates a low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog, suggesting no widespread or known active exploits. Exploitation likely requires the attacker to supply a malicious link in another app that then directs Firefox to open a non‑HTTP scheme. The CVE description does not mention remote code execution or other destructive actions.