CVE-2026-2032
Medium · 4.3CVSS
4.3
EPSS
0.2%
Published
Feb 16, 2026
CISA due date
—
The record
Malicious scripts that interrupt new tab page loading could cause desynchronization between the address bar and page content, allowing the attacker to spoof arbitrary HTML under a trusted domain. This vulnerability was fixed in Firefox for iOS 147.2.1.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Chainguard | firefox | 0 | 0 |
| Wolfi | firefox | 0 | 0 |
Related vulnerabilities
- CVE-2026-4726 Denial-of-service in the XML component. Also affects firefox
- CVE-2026-4724 Undefined behavior in the Audio/Video component. Also affects firefox
- CVE-2026-4729 Memory safety bugs present in Firefox 148 and Thunderbird 148. Also affects firefox
- CVE-2026-4722 Privilege escalation in the IPC component. Also affects firefox
- CVE-2026-4723 Use-after-free in the JavaScript Engine component. Also affects firefox
- CVE-2026-4727 Denial-of-service in the Libraries component in NSS. Also affects firefox
- CVE-2026-4728 Spoofing issue in the Privacy: Anti-Tracking component. Also affects firefox
- CVE-2026-4725 Sandbox escape due to use-after-free in the Graphics: Canvas2D component. Also affects firefox