Advisories · Technology

Mozilla Firefox for iOS.

Every CVE that names Mozilla Firefox for iOS among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-116631 CVE record

CVSS 5.4 Medium

External protocol handler (tel:) address bar spoof
- Mozilla Firefox for iOS
- CWE-451
Not analysed yet 26 Oct 2026
CVE-2026-116632 CVE record

CVSS 5.4 Medium

Facetime protocol handler enabled spoofing
- Mozilla Firefox for iOS
- CWE-451
Not analysed yet 26 Oct 2026
CVE-2026-103417 CVE record

CVSS 5.5 Medium

Saved credentials can be autofilled after cross-origin navigation
- Mozilla Firefox for iOS
- CWE-346
Not analysed yet 13 Oct 2026
CVE-2026-103418 CVE record

CVSS 8.8 High

Universal XSS via the HTML language attribute in Translation Services
- Mozilla Firefox for iOS
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-86853 CVE record

CVSS 4.3 Medium

Repeated external URL scheme launches could potentially cause a denial of service in Firefox for iOS
- Mozilla Firefox for iOS
- CWE-451
Not analysed yet 8 Sept 2026
CVE-2026-81267 CVE record

CVSS 5.4 Medium

Stalled popup navigation could allow address bar origin spoofing in Firefox for iOS
- Mozilla Firefox for iOS
- CWE-451
Not analysed yet 31 Aug 2026
CVE-2026-14906 CVE record

CVSS 5.3 Medium

Malicious webpage titles could allow overwriting of bundled PDF resources when saving webpages as PDFs in Firefox for iOS
- Mozilla Firefox for iOS
- Unrestricted file upload
Not analysed yet 13 Jul 2026
CVE-2026-13356 CVE record

CVSS 6.3 Medium

Interrupted navigation could allow address bar origin spoofing in Firefox for iOS
- Mozilla Firefox for iOS
- CWE-451
Not analysed yet 6 Jul 2026
CVE-2026-53900 CVE record

CVSS 4.3 Medium

Cookie injection was possible when opening a PDF link
- Mozilla Firefox for iOS
- Authentication bypass
- CWE-345
Not analysed yet 16 Jun 2026
CVE-2026-53899 CVE record

CVSS 6.5 Medium

Cross-origin cookies could be leaked when opening a PDF link
- Mozilla Firefox for iOS
- CWE-345
Not analysed yet 16 Jun 2026
CVE-2026-9309 CVE record

CVSS 5.4 Medium

Arbitrary JavaScript execution in internal pages via Reader View JSON-LD injection
- Mozilla Firefox for iOS
- Cross-site scripting (XSS)
Not analysed yet 1 Jun 2026
CVE-2026-9308 CVE record

CVSS 5.4 Medium

Arbitrary JavaScript execution in Reader View due to wrong HTML replacement order
- Mozilla Firefox for iOS
- Cross-site scripting (XSS)
Not analysed yet 1 Jun 2026
CVE-2026-9078 CVE record

CVSS 5.4 Medium

Firefox iOS RTL Domain Rendering Issue in Link Preview
- Mozilla Firefox for iOS
- CWE-451
Not analysed yet 25 May 2026
CVE-2026-8706 CVE record

CVSS 6.5 Medium

Sensitive user data could be leaked to other applications through Reader mode
- Mozilla Firefox for iOS
- Information disclosure
- Authentication bypass
Not analysed yet 19 May 2026
CVE-2026-2634 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Spoofed web content presented under trusted domains using scripted navigation on Firefox iOS
- Mozilla Firefox for iOS
- CWE-451
Not analysed yet 24 Feb 2026
CVE-2026-2032 CVE record

CVSS 4.3 Medium

Interrupted page loads in new tabs could allow website spoofing under trusted domains in Firefox iOS
- Mozilla Firefox for iOS
- CWE-451
Not analysed yet 16 Feb 2026
CVE-2025-14744 CVE record

CVSS 6.5 Medium

Filename spoofing via Unicode Right-to-Left Override in Firefox for iOS
- Mozilla Firefox for iOS
- CWE-451
Not analysed yet 18 Dec 2025
CVE-2025-10859 CVE record

CVSS 4.0 Medium

Data stored in cookies for non-HTML content while browsing Incognito could be viewed after closing private tabs
- Mozilla Firefox for iOS
- Information disclosure
Not analysed yet 30 Sept 2025
CVE-2025-55029 CVE record

CVSS 7.5 High

Malicious scripts could spam popups for denial of service attacks
- Mozilla Firefox for iOS
- Denial of service
Not analysed yet 19 Aug 2025
CVE-2025-55031 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Passkey phishing within Bluetooth range
- Mozilla Firefox for iOS
- Mozilla Focus for iOS
- Open redirect
Not analysed yet 19 Aug 2025
CVE-2025-55028 CVE record

CVSS 6.5 Medium

JavaScript alerts could impede UI interaction or allow denial of service attacks
- Mozilla Firefox for iOS
- Denial of service
Not analysed yet 19 Aug 2025
CVE-2025-55030 CVE record

CVSS 6.1 Medium

Content-Disposition headers incorrectly ignored for some MIME types
- Mozilla Firefox for iOS
- CWE-640
Not analysed yet 19 Aug 2025
CVE-2025-54145 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Scanning a malicious URL utilizing Firefox's open-text scheme with the QR code scanner could load arbitrary websites
- Mozilla Firefox for iOS
- Open redirect
Not analysed yet 19 Aug 2025
CVE-2025-54144 CVE record

CVSS 5.4 Medium

Internal Firefox open-text URL scheme allowed loading of arbitrary URLs
- Mozilla Firefox for iOS
- Open redirect
Not analysed yet 19 Aug 2025
CVE-2025-54143 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Sandboxed iframes could allow local downloads despite sandbox restrictions
- Mozilla Firefox for iOS
- CWE-693
Not analysed yet 19 Aug 2025
CVE-2025-5020 CVE record

CVSS 4.3 Medium

Links using non-HTTP schemes opened from other apps such as Safari could have allowed spoofing of website addresses
- Mozilla Firefox for iOS
- CWE-939
Not analysed yet 21 May 2025
CVE-2025-27425 CVE record

CVSS 4.3 Medium

QR code user confirmation bypass with invalid protocol
- Mozilla Firefox for iOS
- Authentication bypass
Not analysed yet 4 Mar 2025
CVE-2025-27424 CVE record

CVSS 4.3 Medium

Firefox Mobile iOS Address Bar Spoof Using Server-Side Redirect to non-http Scheme
- Mozilla Firefox for iOS
- Open redirect
Not analysed yet 4 Mar 2025
CVE-2025-27426 CVE record

CVSS 5.4 Medium

Firefox Mobile iOS Full Address Bar Spoof Using Server-Side Redirect to internal error page
- Mozilla Firefox for iOS
- Open redirect
Not analysed yet 4 Mar 2025
CVE-2025-23109 CVE record

CVSS 6.5 Medium

Address bar spoofing on iOS using long hostnames
- Mozilla Firefox for iOS
- CWE-346
Not analysed yet 11 Jan 2025
CVE-2025-23108 CVE record

CVSS 4.3 Medium

Firefox Mobile iOS Full Address Bar Spoof Using Open in New Tab and Javascript URI
- Mozilla Firefox for iOS
- Cross-site scripting (XSS)
Not analysed yet 11 Jan 2025
CVE-2024-53976 CVE record

CVSS 5.4 Medium

Clickjacking in Mozilla Firefox for iOS
- Mozilla Firefox for iOS
- CWE-1021
Not analysed yet 26 Nov 2024
CVE-2024-53975 CVE record

CVSS 5.4 Medium

Mozilla Firefox for iOS: Accessing a non-secure HTTP site that uses a non-existent port may cause the SSL padlock…
- Mozilla Firefox for iOS
Not analysed yet 26 Nov 2024
CVE-2024-10004 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Clickjacking in Mozilla Firefox for iOS
- Mozilla Firefox for iOS
- CWE-1021
Not analysed yet 15 Oct 2024
CVE-2024-43111 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Cross-site scripting in Mozilla Firefox for iOS
- Mozilla Firefox for iOS
- Cross-site scripting (XSS)
Not analysed yet 6 Aug 2024
CVE-2024-43113 CVE record

CVSS 6.1 Medium

Cross-site scripting in Mozilla Firefox for iOS
- Mozilla Firefox for iOS
- Cross-site scripting (XSS)
Not analysed yet 6 Aug 2024
CVE-2024-43112 CVE record

CVSS 6.1 Medium

Cross-site scripting in Mozilla Firefox for iOS
- Mozilla Firefox for iOS
- Cross-site scripting (XSS)
Not analysed yet 6 Aug 2024
CVE-2024-38312 CVE record

CVSS 6.5 Medium

Insecure storage of sensitive information in Mozilla Firefox for iOS
- Mozilla Firefox for iOS
- Information disclosure
Not analysed yet 13 Jun 2024
CVE-2024-38313 CVE record

CVSS 4.3 Medium

Mozilla Firefox for iOS: In certain scenarios a malicious website could attempt to display a fake location URL bar…
- Mozilla Firefox for iOS
- CWE-451
Not analysed yet 13 Jun 2024
CVE-2024-31392 CVE record

CVSS 7.5 High

Mozilla Firefox for iOS: If an insecure element was added to a page after a delay…
- Mozilla Firefox for iOS
Not analysed yet 3 Apr 2024
CVE-2024-31393 CVE record

CVSS 4.3 Medium

Mozilla Firefox for iOS: Dragging Javascript URLs to the address bar could cause them to be loaded…
- Mozilla Firefox for iOS
Not analysed yet 3 Apr 2024
CVE-2024-26281 CVE record

CVSS 4.7 Medium

Cross-site scripting in Mozilla Firefox for iOS
- Mozilla Firefox for iOS
- Cross-site scripting (XSS)
Not analysed yet 22 Feb 2024
CVE-2024-26282 CVE record

CVSS 7.1 High

Cross-site scripting in Mozilla Firefox for iOS
- Mozilla Firefox for iOS
- Cross-site scripting (XSS)
Not analysed yet 22 Feb 2024
CVE-2024-26283 CVE record

CVSS 7.8 High

Mozilla Firefox for iOS: An attacker could have executed unauthorized scripts on top origin sites using a…
- Mozilla Firefox for iOS
- Cross-site scripting (XSS)
Not analysed yet 22 Feb 2024
CVE-2024-0953 CVE record

CVSS 6.1 Medium

Open redirect in Mozilla Firefox for iOS
- Mozilla Firefox for iOS
- Open redirect
Not analysed yet 5 Feb 2024
CVE-2023-49061 CVE record

Mozilla Firefox for iOS: An attacker could have performed HTML template injection via Reader Mode and exfiltrated…
- Mozilla Firefox for iOS
Not analysed yet 21 Nov 2023
CVE-2023-49060 CVE record

Mozilla Firefox for iOS: An attacker could have accessed internal pages or data by ex-filtrating a security key…
- Mozilla Firefox for iOS
Not analysed yet 21 Nov 2023
CVE-2023-5758 CVE record

CVSS 6.1 Medium

Cross-site scripting in Mozilla Firefox for iOS
- Mozilla Firefox for iOS
- Cross-site scripting (XSS)
Not analysed yet 24 Oct 2023
CVE-2023-37456 CVE record

NULL pointer dereference in Mozilla Firefox for iOS
- Mozilla Firefox for iOS
- Memory corruption
Not analysed yet 12 Jul 2023
CVE-2023-37455 CVE record

Mozilla Firefox for iOS: The permission request prompt from the site in the background tab was overlaid on top of…
- Mozilla Firefox for iOS
Not analysed yet 12 Jul 2023
CVE-2019-17003 CVE record

CVSS 6.1 Medium

Cross-site scripting in Mozilla Firefox for iOS
- Mozilla Firefox for iOS
- Cross-site scripting (XSS)
Not analysed yet 16 Feb 2023
CVE-2022-31746 CVE record

CVSS 6.5 Medium

Information disclosure in Mozilla Firefox for iOS
- Mozilla Firefox for iOS
- Information disclosure
Not analysed yet 22 Dec 2022
CVE-2022-1887 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

SQL injection in Mozilla Firefox for iOS
- Mozilla Firefox for iOS
- SQL injection
Not analysed yet 22 Dec 2022
CVE-2021-29958 CVE record

Mozilla Firefox for iOS: When a download was initiated, the client did not check whether it was in normal or…
- Mozilla Firefox for iOS
Not analysed yet 24 Jun 2021
CVE-2020-15651 CVE record

Mozilla Firefox for iOS: A unicode RTL order character in the downloaded file name can be used to change the…
- Mozilla Firefox for iOS
Not analysed yet 10 Aug 2020
CVE-2020-15662 CVE record

Mozilla Firefox for iOS: A rogue webpage could override the injected WKUserScript used by the download feature…
- Mozilla Firefox for iOS
Not analysed yet 10 Aug 2020
CVE-2020-15661 CVE record

Mozilla Firefox for iOS: A rogue webpage could override the injected WKUserScript used by the logins autofill…
- Mozilla Firefox for iOS
Not analysed yet 10 Aug 2020
CVE-2020-12414 CVE record

Mozilla Firefox for iOS: IndexedDB should be cleared when leaving private browsing mode and it is not…
- Mozilla Firefox for iOS
Not analysed yet 9 Jul 2020
CVE-2020-12404 CVE record

Mozilla Firefox for iOS: For native-to-JS bridging the app requires a unique token to be passed that ensures…
- Mozilla Firefox for iOS
Not analysed yet 9 Jul 2020
CVE-2020-6830 CVE record

Mozilla Firefox for iOS: For native-to-JS bridging, the app requires a unique token to be passed that ensures…
- Mozilla Firefox for iOS
Not analysed yet 26 May 2020