This vulnerability involves malicious web pages exploiting Firefox for iOS and Focus for iOS to pass FIDO authentication links to the operating system, triggering the hybrid passkey transport mechanism. An attacker physically near the victim (within Bluetooth range) could deceive the user into authenticating the attacker’s device using their passkey, potentially granting unauthorized access to the victim's account. The issue affects Firefox for iOS and Focus for iOS prior to version 142. Mozilla released official fixes in Firefox for iOS 142 and Focus for iOS 142 to address this vulnerability.

Successful exploitation could allow an attacker within Bluetooth range to trick a user into authenticating the attacker’s device to the user’s account using their passkey. This could lead to unauthorized account access with high confidentiality, integrity, and availability impact as reflected by the CVSS score of 9.8. The vendor advisory rates the impact as moderate, indicating significant but not catastrophic consequences.

This vulnerability has been officially fixed by Mozilla in Firefox for iOS 142 and Focus for iOS 142. Users and administrators should update to these versions or later to remediate the issue. No additional mitigation actions are required beyond applying the official update.