Based on the description, it is inferred that the vulnerability is an instance of untrusted cross‑site scripting that permits an attacker to inject and execute arbitrary JavaScript within the context of Focus for iOS or Klar for iOS when the WebKit component renders a web page. This can lead to arbitrary code execution in the app, theft of user data, session hijacking, or modifying app behavior without user consent.

The affected items are Mozilla's Focus for iOS and Klar for iOS. Any installation of these apps prior to version 151.3.1 contains the flaw; the issue was addressed in the 151.3.1 release. No other versions are listed as affected.

Based on the description, it is inferred that the flaw is exploitable from any web page loaded by the app’s WebKit. An attacker can embed malicious JavaScript which will run with the app's privileges. There is no publicly known exploitation (KEV not listed) and no EPSS data is available, but the lack of exploitation data does not reduce the potential impact of a client‑side XSS that can compromise user data. Because the issue is client‑side, an end‑user only needs to open a malicious URL through the app, making the attack vector straightforward. Applying the vendor‑supplied patch removes the vulnerability.