Firefox Focus vulnerabilitiesAnd the versions its exploited flaws hit.
Firefox Focus is made by Mozilla. We track 18 published vulnerabilities in it, across 43 versions. 2 of them are on the list of flaws known to be exploited, the newest added on 7 March 2022. If you run Firefox Focus, check your version against the exploited flaws below and patch those first.
The most recent Firefox Focus flaw added to the known-exploited list is CVE-2022-26485, on 7 March 2022. We keep watching the known-exploited list.
Which versions of Firefox Focus do the exploited flaws hit?
Each exploited flaw lists the versions it affects, usually as ranges. "before 97.3.0" means every version up to, but not including, 97.3.0. Find your version, then patch.
- CVE-2022-26485Exploited list, 7 Mar 2022
Mozilla Firefox Use-After-Free Vulnerability
before 97.3.0 - CVE-2022-26486Exploited list, 7 Mar 2022
Mozilla Firefox Use-After-Free Vulnerability
before 97.3.0
Which Firefox Focus vulnerabilities are being exploited?
2 flaws are on the government list of vulnerabilities known to be exploited. These are the ones criminals are using now, so they go first, whatever their severity score says.
- 8.8Mozilla Firefox Use-After-Free Vulnerability
Mozilla Firefox contains a use-after-free vulnerability in XSLT parameter processing which can be exploited to perform arbitrary code execution.
- 9.6Mozilla Firefox Use-After-Free Vulnerability
Mozilla Firefox contains a use-after-free vulnerability in WebGPU IPC Framework which can be exploited to perform arbitrary code execution.
Which Firefox Focus flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- 14%
Removing an XSLT parameter during processing could have lead to an exploitable use-after-free.
- 2.4%
An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape.
- 0.7%CVE-2023-29534Critical
Different techniques existed to obscure the fullscreen notification in Firefox and Focus for Android.
- 0.6%CVE-2023-25743High
A lack of in app notification for entering fullscreen mode could have lead to a malicious website spoofing browser chrome.<br>*This bug only affects Firefox Focus.
- 0.5%CVE-2023-29546Medium
When recording the screen while in Private Browsing on Firefox for Android the address bar and keyboard were not hidden, potentially leaking sensitive information.
- 0.4%CVE-2025-55031Critical
Malicious pages could use Firefox for iOS to pass FIDO: links to the OS and trigger the hybrid passkey transport.
- 0.4%CVE-2026-8945High
Sandbox escape in Firefox and Firefox Focus for Android.
- 0.4%CVE-2024-0605High
Using a javascript: URI with a setTimeout race condition, an attacker can execute unauthorized scripts on top origin sites in urlbar.
- 0.4%CVE-2024-1563High
An attacker could have executed unauthorized scripts on top origin sites using a JavaScript URI when opening an external URL with a custom Firefox scheme and a timeout race condition.
- 0.4%CVE-2023-6870Medium
Applications which spawn a Toast notification in a background thread may have obscured fullscreen notifications displayed by Firefox.
Running Firefox Focus? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 flaw being exploited affects software Acme tracks
Mozilla Firefox contains a use-after-free vulnerability in XSLT parameter processing which can be exploited to perform arbitrary code execution.
- Matched to
- Firefox Focus on Acme's software list
- What to do
- Patch first, then check for signs of use
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
We track 18 published vulnerabilities listed under the name Firefox Focus, across 43 versions. The most recent Firefox Focus flaw added to the known-exploited list is CVE-2022-26485, on 7 March 2022.
2 are on the list of flaws known to be exploited. The most recently added are CVE-2022-26485 and CVE-2022-26486.
Each flaw names its own versions, usually as ranges. The newest, CVE-2022-26485, affects before 97.3.0. The versions for every exploited flaw are listed on this page.
Create a Precursor Intelligence account and track Firefox Focus. We match it against every published flaw, give each one a risk score from 0 to 100 and keep watching, so you hear about new ones as soon as we know, by email, in the app or by webhook.