CVE-2026-116632Medium· 5.4▾ SunlitA malicious web page could insert arbitrary text into the FaceTime call prompt shown by iOS, potentialy allowing it to display a phishing message inside system UI. This vulnerability was fixed in Firefox for iOS 156.1.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the CISA ADP record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 27.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
A malicious web page could insert arbitrary text into the FaceTime call prompt shown by iOS, potentialy allowing it to display a phishing message inside system UI. This vulnerability was fixed in Firefox for iOS 156.1.
firefox_for_iosRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116631Medium· 5.4External protocol handler (tel:) address bar spoof
CVE-2026-103417Medium· 5.5Firefox for iOS could autofill saved credentials into a new page if cross-origin navigation occurred while the saved-login UI was open
CVE-2026-103418High· 8.8Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in Firefox’s privileged content world and bypass the page’s Content Security Policy…
CVE-2026-118178NoneRSS feed could redirect its subscription to a local file or network share
CVE-2026-118175NoneContent of other messages could be included when replying to a crafted message
CVE-2026-118174NoneDisplaying a message could load an attacker-chosen URL through an OpenPGP key attachment