Skip to content
Mozilla Firefox For vulnerabilities
-
mozilla firefox for ios
Privilege escalation in Firefox for iOS
CVE-2026-121843
8.8 High
-
mozilla firefox for ios
Other issue in Firefox for iOS
CVE-2026-121841
No score
-
mozilla firefox for ios
Privilege escalation in the Reader View component in Firefox for iOS
CVE-2026-121842
8.8 High
-
mozilla firefox for ios
External protocol handler (tel:) address bar spoof
CVE-2026-116631
5.4 Medium
-
mozilla firefox for ios
Facetime protocol handler enabled spoofing
CVE-2026-116632
5.4 Medium
-
mozilla firefox for ios
Saved credentials can be autofilled after cross-origin navigation
CVE-2026-103417
5.5 Medium
-
mozilla firefox for ios
Universal XSS via the HTML language attribute in Translation Services
CVE-2026-103418
8.8 High
-
mozilla firefox for ios, firefox mobile +1 more
Repeated external URL scheme launches could potentially cause a denial of service in Firefox for iOS
CVE-2026-86853
4.3 Medium
-
mozilla firefox for ios, firefox mobile +1 more
Stalled popup navigation could allow address bar origin spoofing in Firefox for iOS
CVE-2026-81267
5.4 Medium
-
mozilla firefox for ios, firefox mobile +1 more
Malicious webpage titles could allow overwriting of bundled PDF resources when saving webpages as PDFs in Firefox for iOS
CVE-2026-14906
5.3 Medium
-
mozilla firefox, firefox for ios +1 more
Interrupted navigation could allow address bar origin spoofing in Firefox for iOS
CVE-2026-13356
6.3 Medium
-
mozilla firefox for ios, firefox mobile +1 more
Cookie injection was possible when opening a PDF link
CVE-2026-53900
4.3 Medium
-
mozilla firefox for ios, firefox mobile +1 more
Cross-origin cookies could be leaked when opening a PDF link
CVE-2026-53899
6.5 Medium
-
mozilla firefox, firefox for ios +1 more
Arbitrary JavaScript execution in internal pages via Reader View JSON-LD injection
CVE-2026-9309
5.4 Medium
-
mozilla firefox, firefox for ios +1 more
Arbitrary JavaScript execution in Reader View due to wrong HTML replacement order
CVE-2026-9308
5.4 Medium
-
mozilla firefox, firefox for ios +1 more
Firefox iOS RTL Domain Rendering Issue in Link Preview
CVE-2026-9078
5.4 Medium
-
mozilla firefox, firefox for ios +1 more
Sensitive user data could be leaked to other applications through Reader mode
CVE-2026-8706
6.5 Medium
-
mozilla firefox, firefox for ios +1 more
Spoofed web content presented under trusted domains using scripted navigation on Firefox iOS
CVE-2026-2634
9.8 Critical
-
mozilla firefox, firefox for ios +1 more
Interrupted page loads in new tabs could allow website spoofing under trusted domains in Firefox iOS
CVE-2026-2032
4.3 Medium
-
mozilla firefox, firefox for ios +1 more
Filename spoofing via Unicode Right-to-Left Override in Firefox for iOS
CVE-2025-14744
6.5 Medium
-
mozilla firefox, firefox for ios +1 more
Data stored in cookies for non-HTML content while browsing Incognito could be viewed after closing private tabs
CVE-2025-10859
4.0 Medium
-
mozilla firefox, firefox for ios +1 more
Malicious scripts could spam popups for denial of service attacks
CVE-2025-55029
7.5 High
-
mozilla firefox, firefox for ios, focus for ios +1 more +3 more
Passkey phishing within Bluetooth range
CVE-2025-55031
9.8 Critical
-
mozilla firefox, firefox for ios +1 more
JavaScript alerts could impede UI interaction or allow denial of service attacks
CVE-2025-55028
6.5 Medium
-
mozilla firefox, firefox for ios +1 more
Content-Disposition headers incorrectly ignored for some MIME types
CVE-2025-55030
6.1 Medium
-
mozilla firefox, firefox for ios +1 more
Scanning a malicious URL utilizing Firefox's open-text scheme with the QR code scanner could load arbitrary websites
CVE-2025-54145
9.1 Critical
-
mozilla firefox, firefox for ios +1 more
Internal Firefox open-text URL scheme allowed loading of arbitrary URLs
CVE-2025-54144
5.4 Medium
-
mozilla firefox, firefox for ios +1 more
Sandboxed iframes could allow local downloads despite sandbox restrictions
CVE-2025-54143
9.8 Critical
-
mozilla firefox, firefox for ios +1 more
Links using non-HTTP schemes opened from other apps such as Safari could have allowed spoofing of website addresses
CVE-2025-5020
4.3 Medium
-
mozilla firefox, firefox for ios +1 more
QR code user confirmation bypass with invalid protocol
CVE-2025-27425
4.3 Medium
-
mozilla firefox, firefox for ios +1 more
Firefox Mobile iOS Address Bar Spoof Using Server-Side Redirect to non-http Scheme
CVE-2025-27424
4.3 Medium
-
mozilla firefox, firefox for ios +1 more
Firefox Mobile iOS Full Address Bar Spoof Using Server-Side Redirect to internal error page
CVE-2025-27426
5.4 Medium
-
mozilla firefox, firefox for ios +1 more
Address bar spoofing on iOS using long hostnames
CVE-2025-23109
6.5 Medium
-
mozilla firefox, firefox for ios +1 more
Firefox Mobile iOS Full Address Bar Spoof Using Open in New Tab and Javascript URI
CVE-2025-23108
4.3 Medium
-
mozilla firefox, firefox for ios +1 more
Under certain circumstances, navigating to a webpage would result in the address missing from the...
CVE-2024-53976
5.4 Medium
-
mozilla firefox, firefox for ios +1 more
Accessing a non-secure HTTP site that uses a non-existent port may cause the SSL padlock icon in...
CVE-2024-53975
5.4 Medium
-
mozilla firefox, firefox for ios +1 more
Opening an external link to an HTTP website when Firefox iOS was previously closed and had an...
CVE-2024-10004
9.1 Critical
-
mozilla firefox, firefox for android +1 more
Under certain conditions, an attacker with the ability to redirect users to a malicious site via...
CVE-2024-8897
6.1 Medium
-
mozilla firefox for ios, firefox mobile +1 more
Long pressing on a download link could potentially allow Javascript commands to be executed...
CVE-2024-43111
6.1 Medium
-
mozilla firefox for ios, firefox mobile +1 more
The contextual menu for links could provide an opportunity for cross-site scripting attacks This...
CVE-2024-43113
6.1 Medium
-
mozilla firefox for ios, firefox mobile +1 more
Long pressing on a download link could potentially provide a means for cross-site scripting This...
CVE-2024-43112
6.1 Medium
-
mozilla firefox for ios, firefox mobile +1 more
In certain scenarios a malicious website could attempt to display a fake location URL bar which...
CVE-2024-38313
4.3 Medium
-
mozilla firefox for ios, firefox mobile +1 more
When browsing private tabs, some data related to location history or webpage thumbnails could be...
CVE-2024-38312
6.5 Medium
-
mozilla firefox, firefox for ios +1 more
Dragging Javascript URLs to the address bar could cause them to be loaded, bypassing restrictions...
CVE-2024-31393
4.3 Medium
-
mozilla firefox, firefox for ios +1 more
If an insecure element was added to a page after a delay, Firefox would not replace the secure...
CVE-2024-31392
7.5 High
-
mozilla firefox, firefox for ios +1 more
Upon scanning a JavaScript URI with the QR code scanner, an attacker could have executed...
CVE-2024-26281
4.7 Medium
-
mozilla firefox, firefox for ios +1 more
Using an AMP url with a canonical element, an attacker could have executed JavaScript from an...
CVE-2024-26282
7.1 High
-
mozilla firefox, firefox for ios +1 more
An attacker could have executed unauthorized scripts on top origin sites using a JavaScript URI...
CVE-2024-26283
7.8 High
-
mozilla firefox for ios, firefox mobile +1 more
When a user scans a QR Code with the QR Code Scanner feature, the user is not prompted before...
CVE-2024-0953
6.1 Medium
-
mozilla firefox for ios, firefox mobile +1 more
An attacker could have performed HTML template injection via Reader Mode and exfiltrated user...
CVE-2023-49061
6.1 Medium
- Show olderLoading…