{"id":"CVE-2026-14906","aliases":["EUVD-2026-43521","GHSA-prx6-r9g2-44x7"],"status":"published","title":"Malicious webpage titles could allow overwriting of bundled PDF resources when saving webpages as PDFs in Firefox for iOS","description":"Pages with malicious titles could potentially allow saved PDF content to overwrite PDF files or bundled content within the Firefox for iOS application sandbox. This vulnerability was fixed in Firefox for iOS 152.4.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00291,"percentile":0.21797,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-434"],"published":"2026-07-13T18:27:03Z","modified":"2026-10-28T02:30:35Z","products":[{"vendor":"mozilla","product":"firefox for ios"},{"vendor":"mozilla","product":"firefox_mobile"}],"references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=2045842","tags":["Permissions Required","report"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-66/","tags":["Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14906","tags":["advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-66"},{"url":"https://github.com/advisories/GHSA-prx6-r9g2-44x7"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/14xxx/CVE-2026-14906.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-14906","title":"Malicious webpage titles could allow overwriting of bundled PDF resources when saving webpages as PDFs in Firefox for iOS","description":"Pages with malicious titles could potentially allow saved PDF content to overwrite PDF files or bundled content within the Firefox for iOS application sandbox. This vulnerability was fixed in Firefox for iOS 152.4.","status":"published","published":"2026-07-13T18:27:03.771Z","modified":"2026-07-13T19:32:16.22Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T13:38:32.13011Z"}],"euvd":[{"id":"EUVD-2026-43521","description":"Pages with malicious titles could potentially allow saved PDF content to overwrite PDF files or bundled content within the Firefox for iOS application sandbox. This vulnerability was fixed in Firefox for iOS 152.4.","status":"published","published":"2026-07-13T18:27:03Z","modified":"2026-07-13T19:32:16Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T18:20:00.696533Z"}],"ghsa":[{"id":"GHSA-prx6-r9g2-44x7","title":"Pages with malicious titles could potentially allow saved PDF content to overwrite PDF files or...","description":"Pages with malicious titles could potentially allow saved PDF content to overwrite PDF files or bundled content within the Firefox for iOS application sandbox. This vulnerability was fixed in Firefox for iOS 152.4.","status":"published","published":"2026-07-13T21:31:24Z","modified":"2026-07-13T21:31:30Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T15:09:26.474991Z"}],"nvd":[{"id":"CVE-2026-14906","description":"Pages with malicious titles could potentially allow saved PDF content to overwrite PDF files or bundled content within the Firefox for iOS application sandbox. This vulnerability was fixed in Firefox for iOS 152.4.","status":"published","published":"2026-07-13T19:16:46.2Z","modified":"2026-10-24T22:10:00.21Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:12:29.114188Z"}],"osv":[{"id":"CVE-2026-14906","title":"Malicious webpage titles could allow overwriting of bundled PDF resources when saving webpages as PDFs in Firefox for iOS","description":"Pages with malicious titles could potentially allow saved PDF content to overwrite PDF files or bundled content within the Firefox for iOS application sandbox. This vulnerability was fixed in Firefox for iOS 152.4.","status":"published","published":"2026-07-13T18:27:03.771Z","modified":"2026-10-28T02:30:35.834351486Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:57.682091Z"}]}}