CVE-2026-14906

The vulnerability CVE-2026-14906 affects Firefox for iOS. Pages with malicious titles could cause saved webpages-as-PDF content to overwrite existing PDF files or bundled content within the Firefox for iOS app sandbox. Affected component is the PDF-saving process; root cause details are not expli...

CVE-2026-53899

CVE-2026-53899 affects Firefox for iOS. The issue arises from partial domain matching when attaching cookies to PDF requests, enabling a malicious site on a suffix domain to receive cookies belonging to the target site. The root cause is tied to how cookies were matched during PDF handling, leadi...

CVE-2026-16373

CVE-2026-16373 is an information-disclosure vulnerability affecting Mozilla Firefox for Android (Privacy component). The public records show the issue was fixed in Firefox 153, with advisories indicating information disclosure could be obtained in the affected component. The entry also notes affe...

CVE-2026-74980

A clickjacking flaw in Firefox for Android's Downloads component allows a malicious page to trick users into unintended downloads. CVSS 6.5 (MEDIUM), network-accessible with user interaction. Fixed in Firefox 154; the Nessus plugin confirms no in-the-wild exploitation is known.

CVE-2026-53900

CVE-2026-53900 concerns Firefox for iOS. The issue: cookies set on the initial PDF request were preserved across cross-origin HTTP redirects in TemporaryDocument, enabling a malicious site to inject cookies into requests to an unrelated target domain. The CVE has a base score of 4.3 (Medium) per ...

CVE-2026-74951

CVE-2026-74951 is a clickjacking vulnerability in Firefox for Android , fixed in Firefox 154 . The flaw allows an attacker to trick a user into performing unintended actions by overlaying transparent or invisible UI elements. The CVSS 3.1 base score is 6.5 (Medium) with a vector of AV:N/AC:L/PR:N...

CVE-2026-16404

CVE-2026-16404 is a spoofing vulnerability in Firefox for Android with a CVSS v3.1 base score of 7.4 (HIGH) . The issue affects the Android flavor of Firefox and was fixed in Firefox 153 . Other connected sources corroborate the same description. No additional technical details (root cause, affec...

CVE-2026-74975

A spoofing issue in the Downloads component of Firefox for Android allows a remote attacker to trick users into downloading or interacting with malicious content, with CVSS 5.4 (MEDIUM). It was fixed in Firefox 154. No in-the-wild exploitation is reported.

CVE-2026-84117

CVE-2026-84117 is a privilege escalation vulnerability in Firefox for Android , allowing an attacker to gain elevated privileges beyond those normally granted to the browser. The CVSS 3.1 score is 8.8 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating a network-based attack r...

CVE-2026-84135

CVE-2026-84135 is a denial of service vulnerability in Firefox Focus for Android , part of Mozilla Firefox. The root cause is not publicly detailed beyond "Other issue." According to Kaspersky's advisory (MFSA2026-82), it can be exploited remotely to cause denial of service. The NVD assigns a CVS...

CVE-2026-81267

CVE-2026-81267 is a stalled popup cross-origin navigation vulnerability in Firefox for iOS . A malicious webpage could stall a popup's cross-origin navigation after commit, causing the address bar to display the destination origin while continuing to render attacker-controlled content — effective...

CVE-2026-84127

CVE-2026-84127 is an information disclosure vulnerability in the WebExtensions component of Firefox for Android . A remote attacker with user interaction could potentially access sensitive data , resulting in a low confidentiality impact . The CNA-assigned CVSS v3.1 score is 4.3 (Medium) (AV:N/AC...