A malicious website can take advantage of Firefox for iOS’s handling of FIDO: links to trigger a hybrid passkey transport to the underlying operating system. When the user accepts the passkey request, the attacker's computer can be logged into the user's account by reusing the supplied passkey. The weakness leading to this exploitation is identified as CWE‑601, indicating an open redirect or link redirection flaw that allows unintended navigation. The consequence is loss of account confidentiality and integrity, as an attacker can gain authenticated access to the victim’s services using the passkey.

Mozilla’s browsers on iOS (Firefox and Focus) are affected. The problem exists in all releases prior to version 142 of each product. Versions 142 and later contain a patch that disables the vulnerable handling of FIDO: URIs.

The CVSS score of 9.8 reflects a high severity of the flaw. The EPSS score indicates that the likelihood of exploitation in the wild is currently very low (<1%). Nevertheless, the vulnerability is not listed in the CISA KEV catalog, meaning no public exploit has been confirmed yet. The likely attack vector is a nearby attacker within Bluetooth range who lures a user into visiting a malicious site that then triggers the passkey prompt. No additional prerequisites beyond proximity and user interaction are required.