This vulnerability involves a scripting issue in Firefox for iOS that causes the address bar to become out of sync with the actual web content before a response is received. As a result, an attacker can craft pages that appear to be from trusted domains, effectively spoofing the URL shown to the user. The issue is tracked as CWE-451 and was reported to Mozilla, who fixed it in Firefox for iOS 147.4. The vulnerability has a CVSS v3.1 score of 9.8, reflecting its critical severity and ease of exploitation without privileges or user interaction.

Successful exploitation allows attackers to present malicious web pages under spoofed domain names in Firefox for iOS, potentially enabling phishing or other social engineering attacks by misleading users about the true origin of the content. The impact affects confidentiality, integrity, and availability as indicated by the CVSS vector. No known active exploits have been reported at this time.

Mozilla has released an official fix for this vulnerability in Firefox for iOS version 147.4. Users and administrators should update to this version or later to fully remediate the issue. There are no vendor advisories indicating that no action is required or that the issue is mitigated by other means. Patch status is confirmed as fixed in the specified version.