CVE-2024-26282: 
NixOS vulnerability analysis and mitigation

CVE-2024-26282 is a security vulnerability discovered in Firefox for iOS versions prior to 123. The vulnerability was disclosed on February 19, 2024, and was reported by security researcher Muneaki Nishimura. The issue affects the way Firefox for iOS handles AMP URLs with canonical elements (Mozilla Advisory).

The vulnerability involves a Universal Cross-Site Scripting (UXSS) issue through a canonical element. When the current URL starts with /amp, Firefox for iOS recognizes a URL indicated by the canonical element as the current page URL. When a page is bookmarked, the URL specified in the canonical element is added instead of the current URL. Firefox didn't validate the given canonical URL, allowing any scheme URL to be added to the bookmark. The vulnerability has been assigned a CVSS v3.1 base score of 7.1 (High) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N (NVD).

An attacker could have executed JavaScript from an opened bookmarked page, potentially leading to unauthorized script execution in the context of other websites. The impact is rated as moderate by Mozilla, as it requires user interaction in the form of creating and using a bookmark (Mozilla Advisory).

The vulnerability has been fixed in Firefox for iOS version 123. The fix involves validating the URL scheme in the metadata helper code to ensure only HTTP and HTTPS schemes are allowed for canonical URLs (Bugzilla).