6.3
Medium
CVE-2026-13356 A malicious webpage could interrupt a pending navigation by enqueuing a synchronous JavaScript dialog, causing the…
Description
A malicious webpage could interrupt a pending navigation by enqueuing a synchronous JavaScript dialog, causing the browser UI to display the destination origin in the address bar while continuing to render attacker-controlled content. This vulnerability was fixed in Firefox for iOS 152.3.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Firefox for iOS 152.3 | earliest → < 152.3 | 152.3 |
References
- bugzilla.mozilla.org bugzilla.mozilla.org
- www.mozilla.org www.mozilla.org
Timeline
- Published
- Last modified
Other CVEs of Firefox for iOS
The 60 CVEs of Firefox for iOS →
CVE-2026-116631
A malicious web page could open a tel link in a window that was showing a different website, causing the phone-call…
5.4
Medium
CVE-2026-116632
A malicious web page could insert arbitrary text into the FaceTime call prompt shown by iOS, potentialy allowing it to…
5.4
Medium
CVE-2026-103417
Firefox for iOS could autofill saved credentials into a new page if cross-origin navigation occurred while the…
5.5
Medium
CVE-2026-103418
Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript, allowing…
8.8
High