CVE-2026-2032 — Interrupted page loads in new tabs could allow website spoofing under trusted domains in Firefox iOS

CVE-2026-2032

Interrupted page loads in new tabs could allow website spoofing under trusted domains in Firefox iOS PUBLISHED

Description (CNA)

Malicious scripts that interrupt new tab page loading could cause desynchronization between the address bar and page content, allowing the attacker to spoof arbitrary HTML under a trusted domain. This vulnerability was fixed in Firefox for iOS 147.2.1.

Affected (CNA)

Vendor / product	Versions
Mozilla / Firefox for iOS	unaffected 147.2.1 through *

CWE

No CWE identifiers supplied.

References

https://bugzilla.mozilla.org/show_bug.cgi?id=2012152
https://www.mozilla.org/security/advisories/mfsa2026-09/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.