Mozilla Foundation Security Advisory 2026-117
Security Vulnerabilities fixed in Firefox for iOS 156.1
- Announced
- October 26, 2026
- Impact
- moderate
- Products
- Firefox for iOS
- Fixed in
-
- Firefox for iOS 156.1
#CVE-2026-116632: Facetime protocol handler enabled spoofing
- Reporter
- xisigr
- Impact
- moderate
Description
A malicious web page could insert arbitrary text into the FaceTime call prompt shown by iOS, potentialy allowing it to display a phishing message inside system UI.
References
#CVE-2026-116631: External protocol handler (tel:) address bar spoof
- Reporter
- Yuyang Zhou
- Impact
- low
Description
A malicious web page could open a tel link in a window that was showing a different website, causing the phone-call prompt to appear as if that site had requested the call.