This vulnerability involves improper handling of drag-and-drop gestures in Mozilla Focus for iOS, allowing JavaScript links dragged to the URL bar to be executed incorrectly. This behavior can be exploited to perform XSS attacks, which may lead to limited confidentiality and integrity impacts. The issue was reported by Muneaki Nishimura and fixed in Focus for iOS 142. The CVSS vector indicates the attack requires network access, low attack complexity, no privileges, user interaction, and results in a scope change with low confidentiality and integrity impacts and no availability impact.

Successful exploitation could allow an attacker to execute malicious JavaScript in the context of the browser, potentially leading to cross-site scripting attacks. This can result in limited compromise of user data confidentiality and integrity within the browser session. There is no impact on system availability. No known exploits have been reported in the wild.

A fix for this vulnerability is available in Mozilla Focus for iOS version 142. Users and administrators should update to this version to remediate the issue. No additional mitigation actions are indicated by the vendor advisory.