CVE-2026-103417

Firefox for iOS could autofill saved credentials into a new page if cross-origin navigation occurred while the saved-login UI was open. Autofill was not bound to the originating page or rejected when its origin changed. This vulnerability was fixed in Firefox for iOS 157.1...

CVE-2026-103418

Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in Firefox’s privileged content world and bypass the page’s Content Security Policy. This vulnerability was fixed in Firefox for iOS 157.1...

CVE-2026-103417 Saved credentials can be autofilled after cross-origin navigation

Firefox for iOS could autofill saved credentials into a new page if cross-origin navigation occurred while the saved-login UI was open. Autofill was not bound to the originating page or rejected when its origin changed. This vulnerability was fixed in Firefox for iOS 157.1...

CVE-2026-103417

Firefox for iOS is vulnerable to a credential autofill issue where saved credentials could be autofilled into a new page following a cross-origin navigation. The root cause is that the autofill mechanism was not bound to the originating page and failed to reject the request when the origin change...

CVE-2026-103418 Universal XSS via the HTML language attribute in Translation Services

Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in Firefox’s privileged content world and bypass the page’s Content Security Policy. This vulnerability was fixed in Firefox for iOS 157.1...

CVE-2026-103418

Firefox for iOS is vulnerable to a Universal XSS flaw because the browser directly interpolates the page’s HTML language attribute into translation JavaScript. This allows an attacker to execute code within the browser's privileged content world and bypass the page’s Content Security Policy . Thi...

PT-2026-111300

Name of the Vulnerable Software and Affected Versions Firefox for iOS versions prior to 157.1 Description Firefox for iOS directly interpolated the page HTML language attribute into translation JavaScript. This allows attacker-controlled markup to execute code within the privileged content world ...

CVE-2026-103418: Improper Neutralization of Input During Web Page Generation

Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in Firefox’s privileged content world and bypass the page’s Content Security Policy. This vulnerability was fixed in Firefox for iOS 157.1...

Security Vulnerabilities fixed in Firefox for iOS 157.1 — Mozilla

Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in Firefox’s privileged content world and bypass the page’s Content Security Policy. Firefox for iOS could autofill saved credentials into a ne...

CVE-2026-86853

A malicious webpage could repeatedly trigger external URL schemes, causing system prompts or external application launches. This could make Firefox for iOS temporarily unusable until the page is closed. This vulnerability was fixed in Firefox for iOS 155.1...

CVE-2026-86853 Repeated external URL scheme launches could potentially cause a denial of service in Firefox for iOS

A malicious webpage could repeatedly trigger external URL schemes, causing system prompts or external application launches. This could make Firefox for iOS temporarily unusable until the page is closed. This vulnerability was fixed in Firefox for iOS 155.1...

CVE-2026-86853 Repeated external URL scheme launches could potentially cause a denial of service in Firefox for iOS

A malicious webpage could repeatedly trigger external URL schemes, causing system prompts or external application launches. This could make Firefox for iOS temporarily unusable until the page is closed. This vulnerability was fixed in Firefox for iOS 155.1...

CVE-2026-86853 Repeated external URL scheme launches could potentially cause a denial of service in Firefox for iOS

A malicious webpage could repeatedly trigger external URL schemes, causing system prompts or external application launches. This could make Firefox for iOS temporarily unusable until the page is closed. This vulnerability was fixed in Firefox for iOS 155.1...

EUVD-2026-72875

A malicious webpage could repeatedly trigger external URL schemes, causing system prompts or external application launches. This could make Firefox for iOS temporarily unusable until the page is closed. This vulnerability was fixed in Firefox for iOS 155.1...

CVE-2026-86853

A malicious webpage can repeatedly trigger external URL schemes in Firefox for iOS , leading to frequent system prompts or the launching of external applications. This behavior can result in a denial of service by making the browser temporarily unusable until the page is closed. This vulnerabilit...

PT-2026-87136

A malicious webpage could repeatedly trigger external URL schemes, causing system prompts or external application launches. This could make Firefox for iOS temporarily unusable until the page is closed. This vulnerability was fixed in Firefox for iOS 155.1...

CVE-2026-86853: User Interface (UI) Misrepresentation of Critical Information

A malicious webpage could repeatedly trigger external URL schemes, causing system prompts or external application launches. This could make Firefox for iOS temporarily unusable until the page is closed. This vulnerability was fixed in Firefox for iOS 155.1...

Security Vulnerabilities fixed in Firefox for iOS 155.1 — Mozilla

A malicious webpage could repeatedly trigger external URL schemes, causing system prompts or external application launches. This could make Firefox for iOS temporarily unusable until the page is closed...

CVE-2026-81267

A malicious webpage could stall a popup's cross-origin navigation after commit, causing the address bar to display the destination origin while continuing to render attacker-controlled content. This vulnerability was fixed in Firefox for iOS 155.0...

CVE-2026-81267 Stalled popup navigation could allow address bar origin spoofing in Firefox for iOS

A malicious webpage could stall a popup's cross-origin navigation after commit, causing the address bar to display the destination origin while continuing to render attacker-controlled content. This vulnerability was fixed in Firefox for iOS 155.0...