Malicious scripts can bypass Firefox for iOS’s popup blocker to open many new tabs, which can consume system resources and render the browser unusable. The weakness is a resource exhaustion flaw (CWE-400) that leads to denial of service.

Mozilla Firefox for iOS versions earlier than 142 are affected. The fix was implemented in Firefox for iOS 142, so all users on 141 and earlier are vulnerable.

The CVSS score is 7.5, indicating a high severity condition. The EPSS score of less than 1% shows a very low probability of observed exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to inject a malicious script into a web page or local content that the target user opens, or otherwise get the script executed in the browser context, to trigger the popup spam. The exploit path requires the user to load the compromised content; no remote code execution or elevated privileges are required. The impact is limited to the client’s device resources, though repeated attacks could degrade the browsing experience over time.