Description
Focus for iOS would not respect a Content-Disposition header of type Attachment and would incorrectly display the content inline, potentially allowing for XSS attacks. This vulnerability was fixed in Focus for iOS 142.
Published: 2025-08-19
Score: 6.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Cross‑Site Scripting (inline XSS)
Action: Patch
AI Analysis

Impact

Focus for iOS ignores a Content‑Disposition header of type attachment for certain MIME types, causing the browser to render the content inline. This flaw allows an attacker to inject and execute JavaScript in the context of the user’s device, a classic cross‑site scripting vulnerability classified as CWE‑601.

Affected Systems

The affected vendor is Mozilla, product Focus for iOS. Versions prior to the 142 release are vulnerable. The related CPE is cpe:2.3:a:mozilla:firefox_focus:*:*:*:*:*:iphone_os:*:*

Risk and Exploitability

The CVSS score of 6.1 indicates medium severity. The EPSS score (<1%) shows a very low probability of exploitation, and the issue is not listed in the CISA KEV catalog. An attacker would need to supply malicious content that a user opens, relying on the browser rendering the attachment inline. No public exploit code is available, and the mitigation is to update the app, keeping risk moderate overall.

Generated by OpenCVE AI on April 20, 2026 at 16:45 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Focus for iOS to version 142 or later
  • Configure iOS to enforce content‑disposition processing for attachments so that inline rendering is prevented
  • Check Mozilla’s security advisories regularly for updates and apply them promptly

Generated by OpenCVE AI on April 20, 2026 at 16:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-25223 Focus for iOS would not respect a Content-Disposition header of type Attachment and would incorrectly display the content inline, potentially allowing for XSS attacks This vulnerability affects Focus for iOS < 142.
History

Mon, 13 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Description Focus for iOS would not respect a Content-Disposition header of type Attachment and would incorrectly display the content inline, potentially allowing for XSS attacks This vulnerability affects Focus for iOS < 142. Focus for iOS would not respect a Content-Disposition header of type Attachment and would incorrectly display the content inline, potentially allowing for XSS attacks. This vulnerability was fixed in Focus for iOS 142.

Thu, 30 Oct 2025 16:30:00 +0000

Type Values Removed Values Added
Title Focus incorrectly ignores Content-Disposition headers for some MIME types

Thu, 21 Aug 2025 18:45:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla firefox Focus
CPEs cpe:2.3:a:mozilla:firefox_focus:*:*:*:*:*:iphone_os:*:*
Vendors & Products Mozilla firefox Focus

Thu, 21 Aug 2025 12:45:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple ios
Mozilla
Mozilla focus For Ios
Vendors & Products Apple
Apple ios
Mozilla
Mozilla focus For Ios

Wed, 20 Aug 2025 16:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-601
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 19 Aug 2025 21:00:00 +0000

Type Values Removed Values Added
Description Focus for iOS would not respect a Content-Disposition header of type Attachment and would incorrectly display the content inline, potentially allowing for XSS attacks This vulnerability affects Focus for iOS < 142.
References

Subscriptions

Apple Ios
Mozilla Firefox Focus Focus For Ios
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-04-13T14:28:57.497Z

Reserved: 2025-08-05T13:26:34.686Z

Link: CVE-2025-55032

cve-icon Vulnrichment

Updated: 2025-08-20T14:01:03.388Z

cve-icon NVD

Status : Modified

Published: 2025-08-19T21:15:28.470

Modified: 2026-04-13T15:17:03.020

Link: CVE-2025-55032

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-20T17:00:12Z

Weaknesses