Focus for iOS would not respect a Content-Disposition header of type Attachment and would incorrectly display the content inline, potentially allowing for XSS attacks. This vulnerability affects Focus for iOS versions earlier than 142.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.1 | CVE-2025-55032 |
Exploitation
To exploit this vulnerability, an attacker could craft a malicious link that, when clicked by a user, would cause the Focus for iOS application to improperly handle the Content-Disposition header. This could lead to the execution of arbitrary scripts in the context of the user’s session, resulting in potential XSS attacks.
Affected Products
- Focus for iOS: A web browser application that fails to handle Content-Disposition headers correctly, leading to security vulnerabilities.
Mitigation
Users are advised to update their Focus for iOS application to version 142 or later to mitigate this vulnerability. Additionally, users should be cautious when clicking on links from untrusted sources.