Malicious scripts that interrupt the loading of a new tab can desynchronize the browser’s address bar and the displayed page, allowing an attacker to inject arbitrary HTML that appears to come from a trusted site. The vulnerability is a client–side scripting flaw that results in deceptive content presentation without the user’s knowledge. It can be exploited by any site that hosts such scripts and does not trigger within a trusted domain context. This flaw permits attackers to mislead users into believing they are on a legitimate site while actually serving malicious content.

Mozilla’s Firefox for iOS is vulnerable. The issue was addressed in Firefox for iOS version 147.2.1 and subsequent releases. Users operating older versions of Firefox on iOS devices must upgrade to eliminate the risk.

The vulnerability carries a CVSS score of 4.3, indicating moderate risk. The EPSS score of less than 1% implies that the likelihood of exploitation is very low at present. The flaw is not listed in the CISA KEV catalog, which further reduces the perceived threat. Exploitation appears to require the user to load a malicious script that interferes with new‑tab navigation; remote exploitation over the network is not directly indicated in the description, so the attack vector is likely user‑initiated browsing. The official fix is a software update, which mitigates the flaw by preventing the script interruption entirely.