Cross-Origin Cookie Injection Vulnerability in Firefox for iOS
CVE-2026-53900

4.3MEDIUM

Key Information:

Vendor

Mozilla
Status
Firefox For iOS
Vendor
CVE Published:
16 June 2026

What is CVE-2026-53900?

The Firefox for iOS application was found to improperly handle cookies across cross-origin HTTP redirects during initial PDF requests. This flaw enables a potential attacker to inject arbitrary cookies into HTTP requests to unrelated domains, posing a significant risk of session hijacking and manipulation. Mozilla addressed this issue in version 152.0, emphasizing the importance of updating to secure browsing.

Affected Version(s)

Firefox for iOS 152.0

References

https://bugzilla.mozilla.org/show_bug.cgi?id=2043204
https://www.mozilla.org/security/advisories/mfsa2026-56/

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Muneaki Nishimura
.