Firefox For Ios (Mozilla) - vulnerabilities (CVEs)

60 CVEs, 4 in the last 30 days, 2 known versions, newest CVE from 2026-10-26. Vendor: Mozilla.

CVEs of Firefox For Ios

CVE-2026-116631 - CVSS 5.4 (medium), 2026-10-26: A malicious web page could open a tel link in a window that was showing a different website, causing the phone-call prompt to appear as if that site had…
CVE-2026-116632 - CVSS 5.4 (medium), 2026-10-26: A malicious web page could insert arbitrary text into the FaceTime call prompt shown by iOS, potentialy allowing it to display a phishing message inside…
CVE-2026-103417 - CVSS 5.5 (medium), 2026-10-13: Firefox for iOS could autofill saved credentials into a new page if cross-origin navigation occurred while the saved-login UI was open. Autofill was not bound…
CVE-2026-103418 - CVSS 8.8 (high), 2026-10-13: Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in…
CVE-2026-86853 - CVSS 4.3 (medium), 2026-09-08: A malicious webpage could repeatedly trigger external URL schemes, causing system prompts or external application launches. This could make Firefox for iOS…
CVE-2026-81267 - CVSS 5.4 (medium), 2026-08-31: A malicious webpage could stall a popup's cross-origin navigation after commit, causing the address bar to display the destination origin while continuing to…
CVE-2026-14906 - CVSS 5.3 (medium), 2026-07-13: Pages with malicious titles could potentially allow saved PDF content to overwrite PDF files or bundled content within the Firefox for iOS application…
CVE-2026-13356 - CVSS 6.3 (medium), 2026-07-06: A malicious webpage could interrupt a pending navigation by enqueuing a synchronous JavaScript dialog, causing the browser UI to display the destination…
CVE-2026-53899 - CVSS 6.5 (medium), 2026-06-16: Firefox for iOS used partial domain matching when attaching cookies to PDF requests, allowing a malicious site on a suffix domain to receive cookies belonging…
CVE-2026-53900 - CVSS 4.3 (medium), 2026-06-16: Firefox for iOS preserved cookies set on the initial PDF request across cross-origin HTTP redirects in TemporaryDocument, allowing a malicious site to inject…
CVE-2026-9309 - CVSS 5.4 (medium), 2026-06-01: Firefox for iOS Reader View did not properly escape HTML tags in JSON-LD metadata. A malicious page could inject markup that changed Reader View behavior and…
CVE-2026-9308 - CVSS 5.4 (medium), 2026-06-01: Firefox for iOS Reader View replaced page content in its HTML template before replacing other internal placeholders. A malicious page could include a…
CVE-2026-9078 - CVSS 5.4 (medium), 2026-05-25: Firefox for iOS displayed specially crafted right-to-left (RTL) and internationalized domain names (IDNs) incorrectly in link preview UI surfaces. A crafted…
CVE-2026-8706 - CVSS 6.5 (medium), 2026-05-19: Firefox for iOS hosted Reader mode on an unauthenticated local web server, allowing another application on the same device to request arbitrary URLs and…
CVE-2026-2634 - CVSS 9.8 (critical), 2026-02-24: Malicious scripts could cause desynchronization between the address bar and web content before a response is received in Firefox iOS, allowing…
CVE-2026-2032 - CVSS 4.3 (medium), 2026-02-16: Malicious scripts that interrupt new tab page loading could cause desynchronization between the address bar and page content, allowing the attacker to spoof…
CVE-2025-14744 - CVSS 6.5 (medium), 2025-12-18: Unicode RTLO characters could allow malicious websites to spoof filenames in the downloads UI for Firefox for iOS, potentially tricking users into saving…
CVE-2025-10859 - CVSS 4 (medium), 2025-09-30: Cookie storage for non-HTML temporary documents was being shared incorrectly with normal browsing content, allowing information from private tabs to escape…
CVE-2025-55031 - CVSS 9.8 (critical), 2025-08-19: Malicious pages could use Firefox for iOS to pass FIDO: links to the OS and trigger the hybrid passkey transport. An attacker within Bluetooth range could…
CVE-2025-55030 - CVSS 6.1 (medium), 2025-08-19: Firefox for iOS would not respect a Content-Disposition header of type Attachment and would incorrectly display the content inline rather than downloading,…
CVE-2025-55029 - CVSS 7.5 (high), 2025-08-19: Malicious scripts could bypass the popup blocker to spam new tabs, potentially resulting in denial of service attacks. This vulnerability was fixed in Firefox…
CVE-2025-54145 - CVSS 9.1 (critical), 2025-08-19: The QR scanner could allow arbitrary websites to be opened if a user was tricked into scanning a malicious link that leveraged Firefox's open-text URL scheme.…
CVE-2025-54144 - CVSS 5.4 (medium), 2025-08-19: The URL scheme used by Firefox to facilitate searching of text queries could incorrectly allow attackers to open arbitrary website URLs or internal pages if a…
CVE-2025-54143 - CVSS 9.8 (critical), 2025-08-19: Sandboxed iframes on webpages could potentially allow downloads to the device, bypassing the expected sandbox restrictions declared on the parent page. This…
CVE-2025-55028 - CVSS 6.5 (medium), 2025-08-19: Malicious scripts utilizing repetitive JavaScript alerts could prevent client user interaction in some scenarios and allow for denial of service attacks. This…
CVE-2025-5020 - CVSS 4.3 (medium), 2025-05-21: Opening maliciously-crafted URLs in Firefox from other apps such as Safari could have allowed attackers to spoof website addresses if the URLs utilized…
CVE-2025-27424 - CVSS 4.3 (medium), 2025-03-04: Websites redirecting to a non-HTTP scheme URL could allow a website address to be spoofed for a malicious page. This vulnerability was fixed in Firefox for…
CVE-2025-27426 - CVSS 5.4 (medium), 2025-03-04: Malicious websites utilizing a server-side redirect to an internal error page could result in a spoofed website URL. This vulnerability was fixed in Firefox…
CVE-2025-27425 - CVSS 4.3 (medium), 2025-03-04: Scanning certain QR codes that included text with a website URL could allow the URL to be opened without presenting the user with a confirmation alert first.…
CVE-2025-23109 - CVSS 6.5 (medium), 2025-01-11: Long hostnames in URLs could be leveraged to obscure the actual host of the website or spoof the website address. This vulnerability was fixed in Firefox for…
CVE-2025-23108 - CVSS 4.3 (medium), 2025-01-11: Opening Javascript links in a new tab via long-press in the Firefox iOS client could result in a malicious script spoofing the URL of the new tab. This…
CVE-2024-53976 - CVSS 5.4 (medium), 2024-11-26: Under certain circumstances, navigating to a webpage would result in the address missing from the location URL bar, making it unclear what the URL was for the…
CVE-2024-53975 - CVSS 5.4 (medium), 2024-11-26: Accessing a non-secure HTTP site that uses a non-existent port may cause the SSL padlock icon in the location URL bar to, misleadingly, appear secure. This…
CVE-2024-10004 - CVSS 9.1 (critical), 2024-10-15: Opening an external link to an HTTP website when Firefox iOS was previously closed and had an HTTPS tab open could in some cases result in the padlock icon…
CVE-2024-43113 - CVSS 6.1 (medium), 2024-08-06: The contextual menu for links could provide an opportunity for cross-site scripting attacks This vulnerability affects Firefox for iOS < 129.
CVE-2024-43112 - CVSS 6.1 (medium), 2024-08-06: Long pressing on a download link could potentially provide a means for cross-site scripting This vulnerability affects Firefox for iOS < 129.
CVE-2024-43111 - CVSS 9.8 (critical), 2024-08-06: Long pressing on a download link could potentially allow Javascript commands to be executed within the browser This vulnerability affects Firefox for iOS < 129.
CVE-2024-38312 - CVSS 6.5 (medium), 2024-06-13: When browsing private tabs, some data related to location history or webpage thumbnails could be persisted incorrectly within the sandboxed app bundle after…
CVE-2024-38313 - CVSS 4.3 (medium), 2024-06-13: In certain scenarios a malicious website could attempt to display a fake location URL bar which could mislead users as to the actual website address This…
CVE-2024-31393 - CVSS 4.3 (medium), 2024-04-03: Dragging Javascript URLs to the address bar could cause them to be loaded, bypassing restrictions and security protections This vulnerability affects Firefox…
CVE-2024-31392 - CVSS 7.5 (high), 2024-04-03: If an insecure element was added to a page after a delay, Firefox would not replace the secure icon with a mixed content security status This vulnerability…
CVE-2024-26283 - CVSS 7.8 (high), 2024-02-22: An attacker could have executed unauthorized scripts on top origin sites using a JavaScript URI when opening an external URL with a custom Firefox scheme.…
CVE-2024-26282 - CVSS 7.1 (high), 2024-02-22: Using an AMP url with a canonical element, an attacker could have executed JavaScript from an opened bookmarked page. This vulnerability affects Firefox for…
CVE-2024-26281 - CVSS 4.7 (medium), 2024-02-22: Upon scanning a JavaScript URI with the QR code scanner, an attacker could have executed unauthorized scripts on the current top origin sites in the URL bar.…
CVE-2024-0953 - CVSS 6.1 (medium), 2024-02-05: When a user scans a QR Code with the QR Code Scanner feature, the user is not prompted before being navigated to the page specified in the code. This may…
CVE-2023-49061 - CVSS 6.1 (medium), 2023-11-21: An attacker could have performed HTML template injection via Reader Mode and exfiltrated user information. This vulnerability affects Firefox for iOS < 120.
CVE-2023-49060 - CVSS 9.8 (critical), 2023-11-21: An attacker could have accessed internal pages or data by ex-filtrating a security key from ReaderMode via the `referrerpolicy` attribute. This vulnerability…
CVE-2023-5758 - CVSS 6.1 (medium), 2023-10-25: When opening a page in reader mode, the redirect URL could have caused attacker-controlled script to execute in a reflected Cross-Site Scripting (XSS) attack.…
CVE-2023-37456 - CVSS 6.5 (medium), 2023-07-12: The session restore helper crashed whenever there was no parameter sent to the message handler. This vulnerability affects Firefox for iOS < 115.
CVE-2023-37455 - CVSS 5.4 (medium), 2023-07-12: The permission request prompt from the site in the background tab was overlaid on top of the site in the foreground tab. This vulnerability affects Firefox…
CVE-2019-17003 - CVSS 6.1 (medium), 2023-02-16: Scanning a QR code that contained a javascript: URL would have resulted in the Javascript being executed.
CVE-2022-31746 - CVSS 6.5 (medium), 2022-12-22: Internal URLs are protected by a secret UUID key, which could have been leaked to web page through the Referrer header. This vulnerability affects Firefox for…
CVE-2022-1887 - CVSS 9.8 (critical), 2022-12-22: The search term could have been specified externally to trigger SQL injection. This vulnerability affects Firefox for iOS < 101.
CVE-2021-29958 - CVSS 4.3 (medium), 2021-06-24: When a download was initiated, the client did not check whether it was in normal or private browsing mode, which led to private mode cookies being shared in…
CVE-2020-15662 - CVSS 6.5 (medium), 2020-08-10: A rogue webpage could override the injected WKUserScript used by the download feature, this exploit could result in the user downloading an unintended file.…
CVE-2020-15661 - CVSS 6.5 (medium), 2020-08-10: A rogue webpage could override the injected WKUserScript used by the logins autofill, this exploit could result in leaking a password for the current domain.…
CVE-2020-15651 - CVSS 4.3 (medium), 2020-08-10: A unicode RTL order character in the downloaded file name can be used to change the file's name during the download UI flow to change the file extension. This…
CVE-2020-12414 - CVSS 6.5 (medium), 2020-07-09: IndexedDB should be cleared when leaving private browsing mode and it is not, the API for WKWebViewConfiguration was being used incorrectly and requires the…
CVE-2020-12404 - CVSS 4.3 (medium), 2020-07-09: For native-to-JS bridging the app requires a unique token to be passed that ensures non-app code can't call the bridging functions. That token could leak when…
CVE-2020-6830 - CVSS 7.5 (high), 2020-05-26: For native-to-JS bridging, the app requires a unique token to be passed that ensures non-app code can't call the bridging functions. That token was being used…