CVE-2025-10290

MediumCVSS 6.5

Published: 16/09/2025(UTC)Updated: 23/10/2026(UTC)Translated: 23/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

In Focus for iOS, opening links via the contextual menu for certain URL schemes failed to load but did not refresh the toolbar correctly, allowing attackers to spoof websites if users were coerced into opening a link via long-press.

Risk Assessment

An attacker can spoof a trusted website and trick the user into disclosing data or performing unsafe actions.

Recommendation

Update Focus for iOS to version 143.0 or later.

Other vulnerabilities in Focus for iOS

CVE-2026-11799High
UXSS vulnerability in Focus for iOS / Klar Webkit navigation. Fixed in Focus for iOS 151.3.1 and Klar for iOS 151.3.1.

Original NVD description (English source)

Opening links via the contextual menu in Focus iOS for certain URL schemes would fail to load but would not refresh the toolbar correctly, allowing attackers to spoof websites if users were coerced into opening a link explicitly through a long-press. This vulnerability was fixed in Focus for iOS 143.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS