CVE-2025-10290

{
  "id": "CVE-2025-10290",
  "sourceIdentifier": "[email protected]",
  "published": "2025-09-16T13:15:41.520",
  "lastModified": "2026-10-23T22:10:00.160",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Opening links via the contextual menu in Focus iOS for certain URL schemes would fail to load but would not refresh the toolbar correctly, allowing attackers to spoof websites if users were coerced into opening a link explicitly through a long-press. This vulnerability was fixed in Focus for iOS 143.0."
    },
    {
      "lang": "es",
      "value": "Abrir enlaces a través del menú contextual en Focus para iOS para ciertos esquemas de URL no se cargarían pero no actualizarían la barra de herramientas correctamente, permitiendo a los atacantes suplantar sitios web si los usuarios fueran coaccionados a abrir un enlace explícitamente mediante una pulsación larga. Esta vulnerabilidad afecta a Focus para iOS anterior a 143.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Mozilla",
          "product": "Focus for iOS",
          "versions": [
            {
              "version": "143.0",
              "lessThanOrEqual": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-09-16T17:30:14.447776Z",
          "id": "CVE-2025-10290",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-451"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:mozilla:firefox_focus:*:*:*:*:*:iphone_os:*:*",
              "versionEndExcluding": "143.0",
              "matchCriteriaId": "F0689DCB-CA40-4BEA-945D-D74C7351ED2D"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1975566",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking",
        "Permissions Required"
      ]
    },
    {
      "url": "https://www.mozilla.org/security/advisories/mfsa2025-76/",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}