CVE-2026-11799 - Vulnerability Details - OpenCVE

ReportizFlow

UXSS in Focus for iOS / Klar Webkit navigation. This vulnerability was fixed in Focus for iOS 151.3.1 and Klar for iOS 151.3.1.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Mozilla	Focus For Ios Klar For Ios

No data.

No data.

References

Link	Providers
https://bugzilla.mozilla.org/show_bug.cgi?id=1975667
https://www.mozilla.org/security/advisories/mfsa2026-55/

History

Wed, 10 Jun 2026 16:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-79
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 10 Jun 2026 11:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Mozilla Mozilla focus For Ios Mozilla klar For Ios
Vendors & Products		Mozilla Mozilla focus For Ios Mozilla klar For Ios

Tue, 09 Jun 2026 21:15:00 +0000

Type	Values Removed	Values Added
Description		UXSS in Focus for iOS / Klar Webkit navigation. This vulnerability was fixed in Focus for iOS 151.3.1 and Klar for iOS 151.3.1.
Title		UXSS in Focus for iOS / Klar Webkit navigation
References		https://bugzilla.mozilla.org/show_bug.cgi?id=1975667 https://www.mozilla.org/security/advisories/mfsa2026-55/

MITRE

Status: PUBLISHED

Assigner: mozilla

Published: 2026-06-09T20:52:02.036Z

Updated: 2026-06-10T15:47:54.890Z

Reserved: 2026-06-09T13:59:49.244Z

Link: CVE-2026-11799

Vulnrichment

Updated: 2026-06-10T15:45:40.639Z

NVD

Status : Awaiting Analysis

Published: 2026-06-09T21:17:03.410

Modified: 2026-06-10T20:14:36.697

Link: CVE-2026-11799

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-11799", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "state": "PUBLISHED", "assignerShortName": "mozilla", "dateReserved": "2026-06-09T13:59:49.244Z", "datePublished": "2026-06-09T20:52:02.036Z", "dateUpdated": "2026-06-10T15:47:54.890Z"}, "containers": {"cna": {"affected": [{"product": "Focus for iOS", "vendor": "Mozilla", "versions": [{"status": "unaffected", "version": "151.3.1", "lessThanOrEqual": "*", "versionType": "rpm"}]}, {"product": "Klar for iOS", "vendor": "Mozilla", "versions": [{"status": "unaffected", "version": "151.3.1", "lessThanOrEqual": "*", "versionType": "rpm"}]}], "descriptions": [{"lang": "en", "value": "UXSS in Focus for iOS / Klar Webkit navigation. This vulnerability was fixed in Focus for iOS 151.3.1 and Klar for iOS 151.3.1.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "UXSS in Focus for iOS / Klar Webkit navigation. This vulnerability was fixed in Focus for iOS 151.3.1 and Klar for iOS 151.3.1."}]}], "title": "UXSS in Focus for iOS / Klar Webkit navigation", "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1975667"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-55/"}], "credits": [{"lang": "en", "value": "Renwa Hiwa"}], "providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2026-06-09T20:52:02.036Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-79", "lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-06-10T15:46:23.194997Z", "id": "CVE-2026-11799", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-10T15:47:54.890Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-11799", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-10T15:46:23.194997Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-10T15:45:40.639Z"}}], "cna": {"title": "UXSS in Focus for iOS / Klar Webkit navigation", "credits": [{"lang": "en", "value": "Renwa Hiwa"}], "affected": [{"vendor": "Mozilla", "product": "Focus for iOS", "versions": [{"status": "unaffected", "version": "151.3.1", "versionType": "rpm", "lessThanOrEqual": "*"}]}, {"vendor": "Mozilla", "product": "Klar for iOS", "versions": [{"status": "unaffected", "version": "151.3.1", "versionType": "rpm", "lessThanOrEqual": "*"}]}], "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1975667"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-55/"}], "descriptions": [{"lang": "en", "value": "UXSS in Focus for iOS / Klar Webkit navigation. This vulnerability was fixed in Focus for iOS 151.3.1 and Klar for iOS 151.3.1.", "supportingMedia": [{"type": "text/html", "value": "UXSS in Focus for iOS / Klar Webkit navigation. This vulnerability was fixed in Focus for iOS 151.3.1 and Klar for iOS 151.3.1.", "base64": false}]}], "providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2026-06-09T20:52:02.036Z"}}}, "cveMetadata": {"cveId": "CVE-2026-11799", "state": "PUBLISHED", "dateUpdated": "2026-06-10T15:47:54.890Z", "dateReserved": "2026-06-09T13:59:49.244Z", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "datePublished": "2026-06-09T20:52:02.036Z", "assignerShortName": "mozilla"}, "dataVersion": "5.2"}