SUSE CVE-2026-116631

A malicious web page could open a tel link in a window that was showing a different website, causing the phone-call prompt to appear as if that site had requested the call. This vulnerability was fixed in Firefox for iOS 156.1...

SUSE CVE-2026-116632

A malicious web page could insert arbitrary text into the FaceTime call prompt shown by iOS, potentialy allowing it to display a phishing message inside system UI. This vulnerability was fixed in Firefox for iOS 156.1...

CVE-2026-116631

The Firefox for iOS browser is affected by a vulnerability where a malicious web page can trigger a tel: link in a window displaying a different website. This causes the resulting phone-call prompt to appear as if it were requested by the original site, potentially leading to address bar spoofing...

EUVD-2026-110068

A malicious web page could open a tel link in a window that was showing a different website, causing the phone-call prompt to appear as if that site had requested the call. This vulnerability was fixed in Firefox for iOS 156.1...

CVE-2026-116631 External protocol handler (tel:) address bar spoof

A malicious web page could open a tel link in a window that was showing a different website, causing the phone-call prompt to appear as if that site had requested the call. This vulnerability was fixed in Firefox for iOS 156.1...

CVE-2026-116632 Facetime protocol handler enabled spoofing

A malicious web page could insert arbitrary text into the FaceTime call prompt shown by iOS, potentialy allowing it to display a phishing message inside system UI. This vulnerability was fixed in Firefox for iOS 156.1...

EUVD-2026-110067

A malicious web page could insert arbitrary text into the FaceTime call prompt shown by iOS, potentialy allowing it to display a phishing message inside system UI. This vulnerability was fixed in Firefox for iOS 156.1...

CVE-2026-116632

A vulnerability in Firefox for iOS allows a malicious web page to insert arbitrary text into the FaceTime call prompt shown by the iOS system. This flaw enables an attacker to display phishing messages directly within the system UI. The issue was addressed in Firefox for iOS 156.1 .

PT-2026-125093

A malicious web page could open a tel link in a window that was showing a different website, causing the phone-call prompt to appear as if that site had requested the call. This vulnerability was fixed in Firefox for iOS 156.1...

Mozilla Firefox for iOS processing logic error vulnerability

Mozilla Firefox for iOS versions prior to 156.1 contain a logic error vulnerability. This vulnerability arises because malicious web pages can open tel links within windows displaying other websites, causing phone call notifications to appear as if they were initiated by those websites...

PT-2026-125094

A malicious web page could insert arbitrary text into the FaceTime call prompt shown by iOS, potentialy allowing it to display a phishing message inside system UI. This vulnerability was fixed in Firefox for iOS 156.1...

Mozilla Firefox for iOS processing logic error vulnerability

Mozilla Firefox for iOS contains a processing logic error vulnerability. This vulnerability allows malicious web pages to insert arbitrary text into FaceTime call prompts displayed on iOS, potentially leading to the display of phishing messages within the system interface...

Security Vulnerabilities fixed in Firefox for iOS 156.1 — Mozilla

A malicious web page could insert arbitrary text into the FaceTime call prompt shown by iOS, potentialy allowing it to display a phishing message inside system UI. A malicious web page could open a tel link in a window that was showing a different website, causing the phone-call prompt to appear ...

CVE-2026-103417

Firefox for iOS could autofill saved credentials into a new page if cross-origin navigation occurred while the saved-login UI was open. Autofill was not bound to the originating page or rejected when its origin changed. This vulnerability was fixed in Firefox for iOS 157.1...

CVE-2026-103418

Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in Firefox’s privileged content world and bypass the page’s Content Security Policy. This vulnerability was fixed in Firefox for iOS 157.1...

CVE-2026-103417

Firefox for iOS is vulnerable to a credential autofill issue where saved credentials could be autofilled into a new page following a cross-origin navigation. The root cause is that the autofill mechanism was not bound to the originating page and failed to reject the request when the origin change...

CVE-2026-103417 Saved credentials can be autofilled after cross-origin navigation

Firefox for iOS could autofill saved credentials into a new page if cross-origin navigation occurred while the saved-login UI was open. Autofill was not bound to the originating page or rejected when its origin changed. This vulnerability was fixed in Firefox for iOS 157.1...

EUVD-2026-98340

Firefox for iOS could autofill saved credentials into a new page if cross-origin navigation occurred while the saved-login UI was open. Autofill was not bound to the originating page or rejected when its origin changed. This vulnerability was fixed in Firefox for iOS 157.1...

CVE-2026-103417 Saved credentials can be autofilled after cross-origin navigation

Firefox for iOS could autofill saved credentials into a new page if cross-origin navigation occurred while the saved-login UI was open. Autofill was not bound to the originating page or rejected when its origin changed. This vulnerability was fixed in Firefox for iOS 157.1...

CVE-2026-103418

Firefox for iOS is vulnerable to a Universal XSS flaw because the browser directly interpolates the page’s HTML language attribute into translation JavaScript. This allows an attacker to execute code within the browser's privileged content world and bypass the page’s Content Security Policy . Thi...