Cross-Site Scripting Vulnerability in Firefox for iOS by Mozilla

CVE-2026-103418

What is CVE-2026-103418?

A cross-site scripting vulnerability was identified in Firefox for iOS, where the application's handling of the page’s HTML language attribute allowed attacker-provided markup to execute JavaScript in privileged contexts. This could lead to the execution of malicious code, effectively bypassing the page's Content Security Policy. This issue was resolved in Firefox for iOS version 157.1, ensuring better security against potential attacks. Users are encouraged to update to mitigate risks associated with this vulnerability.

References