CVE-2026-103418

HIGH · 8.8 CVSS Gepubliceerd: 13-10-2026 CWE-79

Beschrijving

Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in Firefox’s privileged content world and bypass the page’s Content Security Policy. This vulnerability was fixed in Firefox for iOS 157.1.

References

bugzilla.mozilla.org
www.mozilla.org