CVE-2024-1563 is a high severity (CVSS 8.1) race condition in Firefox Focus for iOS before version 122. An attacker could run unauthorized scripts on top origin sites by using a JavaScript URI when opening an external URL with a custom scheme and a timeout. Update Focus to version 122 or later.
What's affected
Mozilla's advisory MFSA 2024-09 says the issue affects Focus for iOS versions before 122 and was fixed in Focus for iOS 122. Mozilla rates its impact High, which matches the record's 8.1 High.
The advisory notes the fix shipped on 22 January 2024 but was not announced until 19 February 2024. The advisory text contains a typo giving the year of the announcement as 2023, so rely on the 2024 date. The researcher credit is on the advisory page.
How to check if you're exposed
On an iPhone or iPad, open the App Store, search for Firefox Focus and check whether an update is pending. The installed version appears in the app's settings under About. Anything below 122 is affected.
If you manage devices with mobile device management, query managed app versions for Focus and push the update where needed.
To check a whole codebase at once, run the free in-browser dependency scan at gold.safeguard.sh/scan. You can also look up the CVE in the Gold directory, and use reachability analysis to see whether your code calls the affected path.
What to do now
- Update Firefox Focus on iOS to version 122 or later.
- Use your device management tool to list and update managed copies.
- Turn on automatic app updates.
- Avoid opening links from untrusted sources in older versions until updated.
- Tell users who installed Focus personally to update it.
Why it matters
The record classes this as CWE-367, time-of-check time-of-use race condition. The app handled a link coming in from outside through a custom scheme, and timing allowed a JavaScript URI to run in the context of the site already open on screen.
Running script in the context of another site is called universal cross-site scripting, and it breaks the browser's basic rule that sites cannot touch each other. The record does not say it was exploited in the wild, and the KEV flag is false.
Quick check
Does this affect Firefox for iOS?
The advisory names Focus for iOS only.
What is the fixed version?
Focus for iOS 122.
Sources
- Mozilla advisory MFSA 2024-09
- Mozilla bug 1863831 (listed in the NVD record, not retrieved)
- NVD record data for CVE-2024-1563
Last reviewed: 19 October 2026.
