Security Vulnerabilities fixed in Firefox for iOS 28 — Mozilla

A rogue webpage could override the injected WKUserScript used by the download feature, this exploit could result in the user downloading an unintended file.
A rogue webpage could override the injected WKUserScript used by the logins autofill, this exploit could result in leaking a password for the current domain.
A unicode RTL order character in the downloaded file name can be used to change the file’s name during the download UI flow to change the file extension.