CVE-2026-2634 is a spoofing flaw in Firefox for iOS, scored 9.8 in the NVD record and rated high by Mozilla. Malicious scripts can desynchronize the address bar from the page content, so an attacker page appears under a trusted domain. Update to Firefox for iOS 147.4 or later.
What's affected
Mozilla's advisory MFSA 2026-12, announced on 20 February 2026, says the flaw is fixed in Firefox for iOS 147.4. Earlier versions of Firefox for iOS are affected. Only the iOS app is named, so the desktop and Android builds are not part of this record.
Mozilla rates the impact as high and credits the report to an outside researcher.
How to check if you're exposed
On an iPhone or iPad, open the Firefox app and look for the version number in the settings screen, or check the App Store listing for pending updates. Anything below 147.4 should be updated.
If you manage devices centrally, look at your mobile device management inventory for the Firefox bundle and filter by version.
What to do now
- Update Firefox for iOS to 147.4 or later through the App Store.
- If you manage devices, push the update and check the version in your device inventory.
- Until the update is in place, treat the address bar with caution on pages you do not trust, and sign in to sensitive sites by typing the address yourself.
- Tell staff that an address bar is a signal, not a guarantee, and that a bookmark or password manager entry is safer than a link.
Why it matters
The weakness is CWE-451, user interface misrepresentation of critical information. A browser's address bar is the main signal people use to judge where they are. If a page can make the bar show one domain while the content comes from another, phishing becomes much more convincing.
Mozilla describes the cause as desynchronization between the address bar and the web content before a response is received. The vector in the NVD record shows no login and a network attack path. The record is not on the CISA Known Exploited Vulnerabilities list.
Quick check
Does this affect Firefox on desktop or Android?
The advisory names Firefox for iOS only, and says it was fixed in 147.4.
Sources
Last reviewed: 19 October 2026.
