This vulnerability allows a malicious webpage to enqueue a synchronous JavaScript dialog during a pending navigation, which interrupts the navigation process. As a result, the browser UI displays the destination origin in the address bar, but the content rendered remains attacker-controlled. This mismatch can be exploited to spoof the address bar origin, misleading users about the legitimacy of the webpage they are interacting with. The flaw was addressed and fixed in Firefox for iOS version 152.3 as per Mozilla's security advisory MFSA 2026-65.

The vulnerability can cause address bar origin spoofing, where users see a legitimate destination URL in the address bar while the content is controlled by an attacker. This can lead to phishing or other social engineering attacks by deceiving users into trusting malicious content. The CVSS score of 6.3 reflects a moderate impact with low complexity and no privileges required, but user interaction is necessary.

A fix is available in Firefox for iOS version 152.3. Users and administrators should update to version 152.3 or later to remediate this vulnerability. There is no indication from the vendor advisory that additional mitigations or workarounds are required.