Mozilla Focus for iOS improperly handled Content-Disposition headers of type Attachment by displaying the content inline rather than as an attachment. This incorrect handling could allow an attacker to execute cross-site scripting (XSS) attacks by injecting malicious scripts into content that should have been treated as downloadable attachments. The vulnerability was reported and fixed in Focus for iOS version 142. The CVSS 3.1 base score is 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity. The vendor advisory confirms the fix and provides additional context on related vulnerabilities.

The vulnerability could allow an attacker to perform cross-site scripting (XSS) attacks by exploiting the incorrect inline display of content that should have been treated as an attachment. This could lead to limited confidentiality and integrity impacts within the context of the browser. There are no known exploits in the wild at this time. The vulnerability affects the Focus for iOS browser prior to version 142.

Mozilla has released an official fix for this vulnerability in Focus for iOS version 142. Users and administrators should update to this version or later to remediate the issue. No additional mitigation steps are required as the vulnerability is addressed by the official patch.