CVE-2025-10290
📋 TL;DR
This vulnerability in Focus for iOS allows attackers to spoof websites by tricking users into opening malicious links through the contextual menu. When users long-press on specially crafted URLs, the browser fails to load the page but doesn't refresh the toolbar, creating a visual deception. This affects Focus for iOS versions below 143.0.
💻 Affected Systems
- Focus for iOS
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Users could be tricked into entering sensitive information on spoofed websites that appear legitimate, leading to credential theft, financial fraud, or malware installation.
Likely Case
Attackers could create convincing phishing pages that appear to be legitimate sites, potentially harvesting login credentials or personal information from targeted users.
If Mitigated
With proper user awareness training and updated software, the risk is limited to sophisticated targeted attacks rather than widespread exploitation.
🎯 Exploit Status
Requires social engineering to coerce users into opening links via long-press; not a drive-by exploit
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 143.0 or later
Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2025-76/
Restart Required: No
Instructions:
1. Open the App Store on your iOS device. 2. Tap your profile icon. 3. Scroll to find Focus for iOS. 4. Tap 'Update' next to Focus. 5. Wait for the update to complete.
🔧 Temporary Workarounds
Avoid long-press link opening
allInstruct users to avoid using the long-press contextual menu to open links and instead tap links normally
🧯 If You Can't Patch
- Disable Focus browser and use alternative browsers that are up-to-date
- Implement user awareness training about phishing risks and safe browsing practices
🔍 How to Verify
Check if Vulnerable:
Check Focus app version in iOS Settings > General > iPhone Storage > FocusCheck Version:
Not applicable for iOS apps; check via device settingsVerify Fix Applied:
Verify Focus version is 143.0 or higher in app settings📡 Detection & Monitoring
Log Indicators:
- Unusual patterns of failed URL loads in browser logs
- Multiple reports of suspicious website behavior from users
Network Indicators:
- Traffic to domains that mimic legitimate sites but have unusual URL structures
SIEM Query:
Not typically applicable for client-side mobile browser vulnerabilities