The QR scanner in Firefox for iOS mishandles URLs that use the open‑text scheme. When a malicious QR code is scanned, the scanner treats the URL as an open‑text link and launches it, allowing an attacker to point the user to any website. The flaw enables the user to be redirected to a malicious or phishing site without their knowledge, potentially resulting in credential theft or other social engineering attacks. The weakness is a classic open redirect (CWE‑601).

Mozilla Firefox for iOS is affected. All releases prior to version 141 contain the vulnerability. The issue was fixed in the 141 release, so only earlier builds need remediation.

The CVSS score of 9.1 marks the flaw as critical. The EPSS score of less than 1 % indicates a very low current chance of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the attack requires only that an attacker present a malicious QR code to a victim who scans it. Once scanned, the flaw immediately redirects to the attacker’s chosen URL, giving the attacker a convenient vector for phishing or other web‑based attacks.