5.5
Medium
CVE-2026-103417 Firefox for iOS could autofill saved credentials into a new page if cross-origin navigation occurred while the…
Description
Firefox for iOS could autofill saved credentials into a new page if cross-origin navigation occurred while the saved-login UI was open. Autofill was not bound to the originating page or rejected when its origin changed. This vulnerability was fixed in Firefox for iOS 157.1.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Firefox for iOS 157.1 | earliest → < 157.1 | 157.1 |
References
- bugzilla.mozilla.org bugzilla.mozilla.org
- www.mozilla.org www.mozilla.org
Timeline
- Published
- Last modified
Other CVEs of Firefox for iOS
The 60 CVEs of Firefox for iOS →
CVE-2026-116631
A malicious web page could open a tel link in a window that was showing a different website, causing the phone-call…
5.4
Medium
CVE-2026-116632
A malicious web page could insert arbitrary text into the FaceTime call prompt shown by iOS, potentialy allowing it to…
5.4
Medium
CVE-2026-103418
Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript, allowing…
8.8
High
CVE-2026-86853
A malicious webpage could repeatedly trigger external URL schemes, causing system prompts or external application…
4.3
Medium