CVE-2024-0605 is a high severity race condition flaw in Firefox Focus for iOS, scored CVSS 7.5. The record and Mozilla say Focus for iOS before version 122 is affected. Update Focus for iOS to version 122 or later, as stated in Mozilla Foundation Security Advisory 2024-03.
What's affected
The record and Mozilla say Focus for iOS before version 122 is affected.
The CVSS vector in the record is CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, with a base score of 7.5 (High). KEV status: not listed in the record.
Fixed version: Update Focus for iOS to version 122 or later, as stated in Mozilla Foundation Security Advisory 2024-03.
Where sources differ: Mozilla rates the issue critical in its advisory, while the CVSS score in the record is 7.5, which is High. Both are noted here.
How to check if you're exposed
On the iPhone or iPad, open Settings, then General, then iPhone Storage or the App Store updates page, and check the version of Firefox Focus. Version 122 or later has the fix. For managed fleets, query your mobile device management tool for the installed Focus build.
What to do now
- Update Firefox Focus for iOS to version 122 or later.
- Enforce the minimum version through mobile device management if you manage devices.
- Tell users not to follow unexpected links until they have updated.
Why it matters
CWE-362 describes this class. A race condition occurs when two operations depend on timing and the program does not enforce the order. An attacker who can win the race may get a result the code never intended. In a browser, that can undermine the checks that tie a page to its origin.
The record does not mark this CVE as exploited in the wild, and it is not in the CISA KEV catalog. Published 2024-01-22.
Safeguard Gold keeps a page for this CVE at gold.safeguard.sh, and the free in-browser dependency scan can show whether software you build bundles related components.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is CVE-2024-0605 exploited in the wild?
The record's KEV flag is false, and none of the pages I fetched said otherwise. That is not proof of safety, so still patch or restrict access.
Does this affect desktop Firefox?
The record and Mozilla name Focus for iOS only. Read the advisory for other Mozilla products.
Sources
- Mozilla Foundation Security Advisory 2024-03
- Safeguard Gold entry for CVE-2024-0605
- NVD record data for CVE-2024-0605.
Last reviewed: 19 October 2026.
