A malicious webpage can interrupt an ongoing navigation by enqueuing a synchronous JavaScript dialog. When this occurs, Firefox for iOS updates the address bar to display the intended destination origin while the page continues to render attacker-controlled content. The flaw, identified as a race condition (CWE-451), lets an attacker mislead users into believing they, or other social engineering attacks.

Mozilla Firefox for iOS versions earlier than 152.3 are affected; the issue was addressed in Firefox for iOS 152.3 and later.

Based on the description, it is inferred that the can be exploited via a malicious webpage that triggers a synchronous JavaScript dialog during navigation. The CVSS score of 6.3 indicates moderate severity, while the EPSS score of < 1 % suggests a low but non-zero likelihood of exploitation. Although not listed in the CISA KEV catalog, the possibility of phishing through address-bar spoofing increases the practical risk. The attack path involves enqueuing a synchronous dialog to delay navigation completion so that the UI shows the intended origin while the attacker-controlled content continues to render, creating a spoofed state.