Autofill Credential Exposure in Firefox for iOS by Mozilla
CVE-2026-103417

5.5MEDIUM

Key Information:

Vendor

Mozilla
Status
Firefox For iOS
Vendor
CVE Published:
13 October 2026

What is CVE-2026-103417?

A vulnerability in Firefox for iOS allowed saved credentials to be autofilled into a new page without being restricted by the original page's context. This occurred during cross-origin navigation while the saved-login user interface was displayed, potentially exposing sensitive information. Mozilla addressed this issue in version 157.1, enhancing security measures to ensure autofill behavior is bound to the originating page's context.

Affected Version(s)

Firefox for iOS 157.1

References

https://bugzilla.mozilla.org/show_bug.cgi?id=2068171
https://www.mozilla.org/security/advisories/mfsa2026-105/

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

planctonone
.