CVE-2024-0606

Name of the Vulnerable Software and Affected Versions Focus for iOS versions prior to 122

Description The issue allows an attacker to execute unauthorized scripts on a legitimate site through UXSS (Universal Cross-Site Scripting) by using the window.open() function to open a JavaScript URI. This leads to unauthorized actions within the user's loaded webpage.

Recommendations For Focus for iOS versions prior to 122, update to version 122 or later to resolve the issue. As a temporary workaround, consider restricting the use of the window.open() function with JavaScript URIs to minimize the risk of exploitation.