CVE-2026-2634: 
NixOS vulnerability analysis and mitigation

CVE-2026-2634 is an address bar spoofing vulnerability in Firefox for iOS, classified as "Spoofed web content presented under trusted domains using scripted navigation on Firefox iOS." Malicious scripts can cause a desynchronization between the address bar and web content before a response is received, allowing attacker-controlled pages to be displayed under spoofed domains. It affects Firefox for iOS versions prior to 147.4 and was publicly disclosed on February 20, 2026, via Mozilla Foundation Security Advisory 2026-12. The vulnerability was reported by researcher Renwa and carries a CVSS v3.1 base score of 9.8 (Critical) (Mozilla Advisory).

The root cause is classified as CWE-451 (User Interface Misrepresentation of Critical Information), where the browser's address bar fails to accurately reflect the actual origin of displayed content. By using scripted navigation techniques, a malicious page can trigger a navigation event that updates the address bar to display a trusted domain while the browser continues to render attacker-controlled content — exploiting a race condition that occurs before a server response is received. No authentication or user interaction beyond visiting a malicious page is required, making the attack vector entirely network-based and low-complexity. The underlying bug is tracked as Mozilla Bug 1975529, though the bug report is access-restricted (Mozilla Advisory).

Successful exploitation enables attackers to present phishing pages that appear to originate from legitimate, trusted domains in the Firefox iOS address bar, deceiving users into believing they are on a genuine website. This creates a high-risk vector for credential theft, session hijacking, malware distribution, and other social engineering attacks targeting iOS users. The confidentiality and integrity impacts are high, as users may submit sensitive information (passwords, financial data) to attacker-controlled infrastructure under the false impression of visiting a trusted site (Mozilla Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Mozilla Advisory). The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018%, indicating a currently low probability of exploitation in the near term. No threat actor attribution has been reported.

1. Set up a malicious web server: Host an attacker-controlled page designed to initiate scripted navigation targeting a trusted domain (e.g., a banking or social media site).
2. Lure the victim: Deliver a link to the malicious page via phishing email, SMS, or social media, targeting Firefox for iOS users on versions prior to 147.4.
3. Trigger scripted navigation: When the victim loads the malicious page, execute JavaScript that initiates a navigation event toward a legitimate-looking URL (e.g., via window.location or similar navigation APIs), causing the address bar to update to the spoofed domain before a server response is received.
4. Serve attacker-controlled content: While the address bar displays the trusted domain, the browser continues rendering the attacker's page content, creating a convincing phishing environment.
5. Harvest credentials or deliver malware: Present a fake login form or malicious download under the spoofed domain to steal user credentials or distribute malware (Mozilla Advisory).

Mozilla has released Firefox for iOS version 147.4, which resolves this vulnerability. Users should immediately update Firefox for iOS to version 147.4 or later via the Apple App Store. No configuration-based workaround is available; updating is the only remediation. Organizations managing iOS devices via MDM should push the update as a priority given the high CVSS score and the phishing risk posed by address bar spoofing (Mozilla Advisory).

The vulnerability was reported to Mozilla by security researcher Renwa and was rated "high" impact by Mozilla in their official advisory. No significant public commentary, media coverage, or notable researcher discussion beyond the advisory itself has been identified at this time (Mozilla Advisory).