A malicious web page could open a tel link in a window that was showing a different website, causing the phone-call prompt to appear as if that site…
A malicious web page could open a tel link in a window that was showing a different website, causing the phone-call prompt to appear as if that site had requested the call. This vulnerability was fixed in Firefox for iOS 156.1.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Mozilla
- Product
- Firefox for iOS
- CVSS v3.1
- 5.4 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
- Exploitation
- SSVC none, automatable no, impact partial
- Fix
- available
- Weakness
- CWE-451
- Exposure class
- Mobile OS, Browser
- NVD status
- Received
Why it ranks 21 (Routine)
- CVSS v3.1 5.4 medium
- Product class: mobile OS, browser
- Widely deployed vendor product (Mozilla)
- Fix available
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.