HTML Tag Injection Issue in Firefox for iOS

CVE-2026-9309

What is CVE-2026-9309?

A vulnerability in the Firefox for iOS Reader View allowed improper escaping of HTML tags in JSON-LD metadata. This flaw could enable a malicious webpage to inject markup that alters the behavior of Reader View, leading to the unintended leakage of sensitive URL parameters. These leaked parameters could grant access to internal pages, posing risks of arbitrary JavaScript execution within an internal origin. The vulnerability has been addressed in version 151.2 of Firefox for iOS.

References