CVE-2026-11799: Focus/Klar for iOS UXSS Vulnerability

CVE-2026-11799 Overview

CVE-2026-11799 is a Universal Cross-Site Scripting (UXSS) vulnerability affecting Mozilla Focus for iOS and Klar for iOS. The flaw resides in the WebKit navigation handling used by both privacy-focused browsers. An attacker who controls a malicious page can inject script that executes in the context of an unrelated origin, breaking the same-origin policy. The issue is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation). Mozilla addressed the defect in Focus for iOS 151.3.1 and Klar for iOS 151.3.1.

Critical Impact
Successful exploitation allows script execution across origin boundaries, enabling session theft, credential harvesting, and arbitrary actions in the victim's browsing context.

Affected Products

Mozilla Focus for iOS prior to 151.3.1
Mozilla Klar for iOS prior to 151.3.1
WebKit-based navigation code paths used by these mobile browsers

Discovery Timeline

2026-06-09 - CVE-2026-11799 published to the National Vulnerability Database
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-11799

Vulnerability Analysis

The vulnerability is a Universal Cross-Site Scripting condition in the WebKit navigation logic that Focus and Klar use on iOS. Because both browsers wrap Apple's WebKit engine, navigation events that fail to enforce origin separation allow injected JavaScript to run inside a target origin rather than the attacker's origin. Unlike conventional reflected or stored XSS, a UXSS bypasses the browser's same-origin policy itself. An attacker can therefore read cookies, local storage, and DOM contents belonging to any site the victim visits in the affected browser session. Mozilla tracked the defect internally as bug 1975667 and published mitigation guidance in advisory MFSA-2026-55.

Root Cause

The defect originates in how navigation transitions are processed inside the embedded WebKit view. When a page initiates a navigation that the browser shell handles improperly, the resulting document context is associated with the wrong security origin. Script content supplied by the attacker is then evaluated against the privileges of the destination origin. Full root-cause details are tracked in the Mozilla Bug Report #1975667.

Attack Vector

Exploitation is remote and requires no authentication or user interaction beyond loading attacker-controlled content. A victim using a vulnerable build of Focus or Klar on iOS only needs to visit a crafted page or follow a malicious link. The attacker chains a navigation primitive with JavaScript payload delivery so that the script executes within an unintended origin. No memory corruption or privilege escalation on the device is required. Refer to the Mozilla Security Advisory MFSA-2026-55 for vendor-confirmed exploitation context.

// No verified public proof-of-concept code is available.
// Conceptual flow:
//   1. Victim opens attacker.example in Focus/Klar for iOS < 151.3.1
//   2. Attacker triggers a crafted WebKit navigation to victim-bank.example
//   3. Injected script runs in the security context of victim-bank.example
//   4. Script exfiltrates cookies, tokens, or DOM contents

Detection Methods for CVE-2026-11799

Indicators of Compromise

Outbound HTTPS requests from mobile devices to attacker infrastructure shortly after a redirect chain involving multiple origins.
Web server logs showing requests carrying session tokens or cookies that originated from an unexpected Referer header.
Reports from users of Focus or Klar for iOS describing unexpected content overlays, login prompts, or session resets.

Detection Strategies

Inventory iOS endpoints to identify installations of Focus or Klar at versions earlier than 151.3.1 using mobile device management (MDM) telemetry.
Inspect web application logs for anomalous cross-origin behavior, including duplicate sessions or sudden privilege changes tied to mobile user agents.
Correlate URL filtering and DNS telemetry for navigation sequences that hop between unrelated domains in rapid succession.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting on internal web properties to capture unexpected script sources.
Track mobile browser version distribution through MDM compliance dashboards and alert on outdated builds.
Monitor authentication services for session anomalies, such as concurrent sessions from the same account on iOS user agents.

How to Mitigate CVE-2026-11799

Immediate Actions Required

Update Focus for iOS to version 151.3.1 or later through the Apple App Store.
Update Klar for iOS to version 151.3.1 or later through the Apple App Store.
Enforce minimum application versions via MDM policy to block use of vulnerable builds on managed devices.

Patch Information

Mozilla resolved CVE-2026-11799 in Focus for iOS 151.3.1 and Klar for iOS 151.3.1. Patch details and the full list of fixed issues are available in the Mozilla Security Advisory MFSA-2026-55. The associated tracking ticket is Mozilla Bug Report #1975667.

Workarounds

Direct users to a different up-to-date iOS browser until Focus or Klar can be upgraded to 151.3.1.
Restrict access to sensitive web applications from iOS devices running unpatched Focus or Klar builds.
Apply strict CSP and SameSite=Strict cookie attributes on web applications to limit the impact of cross-origin script execution.

bash

# Example MDM compliance check (pseudocode)
if app.bundle_id in ["org.mozilla.ios.Focus", "org.mozilla.ios.Klar"]:
    if app.version < "151.3.1":
        mark_device_noncompliant(reason="CVE-2026-11799")
        block_access(resource="corporate_web_apps")