Today, the team at v12 released a video showing a PoC of Universal Account Takeover affecting Firefox Focus of iOS version.
The PoC were released because it is been almost a year the vuln reported, but it is not patched yet.
The video below is demonstration of the vulnerability. We can see that,your X, Google, Reddit, can be taken over only in one click of a link.
Vulnerability explanation and the partly PoC can be seen here:
https://github.com/v12-security/pocs/tree/main/firefox
@snoozzze @firefox Yeah, it is pretty bad.
Funny that their use of Mythos didn’t fix this vuln, or maybe they only care about their computer Web Browser.
😩
Because the iOS version of Firefox uses WebKit not Geko. You can blame Apple for the walled garden full of holes for this.
The bug isn’t in any other WebKit browser.