firefox_for_ios vulnerabilities
CVEs whose affected-version data names the firefox_for_ios package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
4 CVEsRSS
CVE-2026-116632Medium· 5.4Facetime protocol handler enabled spoofing
A malicious web page could insert arbitrary text into the FaceTime call prompt shown by iOS, potentialy allowing it to display a phishing message inside system UI. This vulnerability was fixed in Firefox for iOS 156.1.
CVE-2026-116631Medium· 5.4External protocol handler (tel:) address bar spoof
A malicious web page could open a tel link in a window that was showing a different website, causing the phone-call prompt to appear as if that site had requested the call. This vulnerability was fixed in Firefox for iOS 156.1.
CVE-2026-103418High· 8.8Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in Firefox’s privileged content world and bypass the page’s Content Security Policy…
Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in Firefox’s privileged content world and bypass the page’s Content Security Policy…
CVE-2026-103417Medium· 5.5Firefox for iOS could autofill saved credentials into a new page if cross-origin navigation occurred while the saved-login UI was open
Firefox for iOS could autofill saved credentials into a new page if cross-origin navigation occurred while the saved-login UI was open. Autofill was not bound to the originating page or rejected when its origin changed. This vulnerabilit…