CVE-2026-11799: UXSS in Focus for iOS / Klar Webkit navigation

Synopsis

A universal cross-site scripting (UXSS) vulnerability affects Mozilla Focus for iOS and Klar for iOS in their WebKit navigation handling. The flaw is reachable over the network without any authentication or user interaction, allowing a remote attacker to inject and execute arbitrary scripts in the context of any origin within the browser. Successful exploitation gives an attacker full read access to data across browsing contexts, including session tokens, cookies, and page contents. A patched-image rebuild at version 151.3.1 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the affected application over the network; no local or physical access is needed.

• AuthenticationNot required

  No account or credential of any privilege level is needed to trigger the vulnerability.

• Victim interactionNot required

  The exploit fires without any action by a user, such as clicking a link or opening a file.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, specific memory layout, or environmental prerequisites are required.

Blast Radius

• Attacker reads session tokens, cookies, and authentication credentials stored in or accessible from any browsing context within the affected browser.
• Attacker reads page contents and form data across arbitrary origins, bypassing the same-origin policy that normally isolates sites from one another.
• Sensitive user data displayed in other open tabs or frames, such as personal account details or financial information, is exposed to the attacker.