Mozilla Foundation Security Advisory 2026-105
Security Vulnerabilities fixed in Firefox for iOS 157.1
- Announced
- October 5, 2026
- Impact
- high
- Products
- Firefox for iOS
- Fixed in
-
- Firefox for iOS 157.1
#CVE-2026-103418: Universal XSS via the HTML language attribute in Translation Services
- Reporter
- Muneaki Nishimura
- Impact
- high
Description
Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in Firefox’s privileged content world and bypass the page’s Content Security Policy.
References
#CVE-2026-103417: Saved credentials can be autofilled after cross-origin navigation
- Reporter
- planctonone
- Impact
- moderate
Description
Firefox for iOS could autofill saved credentials into a new page if cross-origin navigation occurred while the saved-login UI was open. Autofill was not bound to the originating page or rejected when its origin changed.