Firefox Focus
Vendor:
First CVE: Dec 22, 2022 · Active for 3 years
20
Total CVEs
More Total CVEs than 94% of tracked products
4.0
Avg CVEs / Year
Higher CVE frequency than 83% of tracked products
6.8
Avg CVSS
Higher Avg CVSS than 36% of tracked products
10.0%
KEV Rate
Higher KEV Rate than 97% of tracked products
Trends Over Time
The number and severity of CVEs published that impact Firefox Focus over time
Volume of CVEsAvg CVSS Base Score
First CVE
Dec 22, 2022
3 years ago
Most Recent CVE
May 19, 2026
66 days ago
CVE Severity & Scoring
Firefox Focus20 CVEs
60%
25%
15%
All CVEs352,231 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local1 (5.0%)
Network19 (95.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low17 (85.0%)
High3 (15.0%)
Unknown0 (0.0%)
User Interaction
None4 (20.0%)
Unknown0 (0.0%)
Required16 (80.0%)
Privileges Required
Low0 (0.0%)
High0 (0.0%)
None20 (100.0%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (20 CVEs).
20 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-26485HIGH Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw. This vulnerability affe | Dec 22, 2022 | 8.8 | 73 | YES | NO |
CVE-2022-26486CRITICAL An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild abusing this flaw. This | Dec 22, 2022 | 9.6 | 69 | YES | NO |
CVE-2026-8945HIGH Sandbox escape in Firefox and Firefox Focus for Android. This vulnerability was fixed in Firefox 151. | May 19, 2026 | 7.5 | 33 | NO | NO |
CVE-2025-55031CRITICAL Malicious pages could use Firefox for iOS to pass FIDO: links to the OS and trigger the hybrid passkey transport. An attacker within Bluetooth range could have used this to trick t | Aug 19, 2025 | 9.8 | 31 | NO | NO |
CVE-2023-29534CRITICAL Different techniques existed to obscure the fullscreen notification in Firefox and Focus for Android. These could have led to potential user confusion and spoofing attacks.
*This | Jun 19, 2023 | 9.1 | 26 | NO | NO |
CVE-2025-10290MEDIUM Opening links via the contextual menu in Focus iOS for certain URL schemes would fail to load but would not refresh the toolbar correctly, allowing attackers to spoof websites if u | Sep 16, 2025 | 6.5 | 22 | NO | NO |
CVE-2024-0605HIGH Using a javascript: URI with a setTimeout race condition, an attacker can execute unauthorized scripts on top origin sites in urlbar. This bypasses security measures, potentially l | Jan 22, 2024 | 7.5 | 22 | NO | NO |
CVE-2025-55033MEDIUM Dragging JavaScript links to the URL bar in Focus for iOS could be utilized to run malicious scripts, potentially resulting in XSS attacks. This vulnerability was fixed in Focus fo | Aug 19, 2025 | 6.1 | 21 | NO | NO |
CVE-2025-55032MEDIUM Focus for iOS would not respect a Content-Disposition header of type Attachment and would incorrectly display the content inline, potentially allowing for XSS attacks. This vulnera | Aug 19, 2025 | 6.1 | 21 | NO | NO |
CVE-2024-1563HIGH An attacker could have executed unauthorized scripts on top origin sites using a JavaScript URI when opening an external URL with a custom Firefox scheme and a timeout race conditi | Feb 22, 2024 | 8.1 | 21 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (20 CVEs).
CISA KEV
2 CVEs
10.0% of CVEs· 97th percentile
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (20 CVEs).
Media Mentions
Signals from CVEs in this product scope (20 CVEs).
Top CNAs Publishing CVEs For Firefox Focus
Top CWEs
Versions
No cataloged versions.