5.4
Moyenne
CVE-2026-9309 Firefox for iOS Reader View did not properly escape HTML tags in JSON-LD metadata
Description
Firefox for iOS Reader View did not properly escape HTML tags in JSON-LD metadata. A malicious page could inject markup that changed Reader View behavior and leaked sensitive URL parameters. These parameters could then be used to access internal pages, potentially resulting in arbitrary JavaScript execution in an internal origin. This vulnerability was fixed in Firefox for iOS 151.2.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Firefox for iOS 151.2 | premières → < 151.2 | 151.2 |
Références
- bugzilla.mozilla.org bugzilla.mozilla.org
- www.mozilla.org www.mozilla.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de Firefox for iOS
Les 60 CVE de Firefox for iOS →
CVE-2026-116631
A malicious web page could open a tel link in a window that was showing a different website, causing the phone-call…
5.4
Moyenne
CVE-2026-116632
A malicious web page could insert arbitrary text into the FaceTime call prompt shown by iOS, potentialy allowing it to…
5.4
Moyenne
CVE-2026-103417
Firefox for iOS could autofill saved credentials into a new page if cross-origin navigation occurred while the…
5.5
Moyenne
CVE-2026-103418
Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript, allowing…
8.8
Élevée