A malicious webpage can interrupt an ongoing navigation by enqueuing a synchronous JavaScript dialog. When this occurs, Firefox for iOS updates the address bar to display the intended destination origin while the page continues to render attacker‐controlled content. The flaw, identified as a race condition (CWE-451), lets an attacker mislead users into believing they, or other social engineering attacks.

Mozilla Firefox for iOS versions earlier than 152.3 are affected; the issue was addressed in Firefox for iOS 152.3 and later.

Based on the description, it is inferred that the can be exploited via a malicious webpage that triggers a synchronous JavaScript dialog during navigation. The CVSS score of 6.3 indicates moderate severity, while the EPSS score of < 1 % suggests a low but non‑zero likelihood of exploitation. Although not listed in the CISA KEV catalog, the possibility of phishing through address‑bar spoofing increases the practical risk. The attack path involves enqueuing a synchronous dialog to delay navigation completion so that the UI shows the intended origin while the attacker‑controlled content continues to render, creating a spoofed state.