CVE-2026-2032

Interrupted page loads in new tabs could allow website spoofing under trusted domains in Firefox iOS

Medium · published February 16, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
7.1
In the wild
Unconfirmed
What it is

Malicious scripts that interrupt new tab page loading could cause desynchronization between the address bar and page content, allowing the attacker to spoof arbitrary HTML under a trusted domain. This vulnerability was fixed in Firefox for iOS 147.2.1.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00180 · 7.1th percentile
Published
2026-02-16T14:13Z
EPSS history
Timeline
  • 16 FEB 14:13Z
    Interrupted page loads in new tabs could allow website spoofing under trusted domains in Firefox iOS
    cvelistv5