Mozilla Firefox for iOS
60 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-116631 | fixed in 156.1 | External protocol handler (tel:) address bar spoof | MEDIUM 5.4 | 0.2 % | ||
| CVE-2026-116632 | fixed in 156.1 | Facetime protocol handler enabled spoofing | MEDIUM 5.4 | 0.2 % | ||
| CVE-2026-103417 | fixed in 157.1 | Saved credentials can be autofilled after cross-origin navigation | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-103418 | fixed in 157.1 | Universal XSS via the HTML language attribute in Translation Services | HIGH 8.8 | 0.3 % | ||
| CVE-2026-86853 | fixed in 155.1 | Repeated external URL scheme launches could potentially cause a denial of service in Firefox for iOS | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-81267 | fixed in 155.0 | Stalled popup navigation could allow address bar origin spoofing in Firefox for iOS | MEDIUM 5.4 | 0.3 % | ||
| CVE-2026-14906 | fixed in 152.4 | Malicious webpage titles could allow overwriting of bundled PDF resources when saving webpages as PDFs in Firefox for iOS | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-13356 | fixed in 152.3 | Interrupted navigation could allow address bar origin spoofing in Firefox for iOS | MEDIUM 6.3 | 0.2 % | ||
| CVE-2026-53900 | fixed in 152.0 | Cookie injection was possible when opening a PDF link | MEDIUM 4.3 | 0.1 % | ||
| CVE-2026-53899 | fixed in 152.0 | Cross-origin cookies could be leaked when opening a PDF link | MEDIUM 6.5 | 0.1 % | ||
| CVE-2026-9309 | fixed in 151.2 | Arbitrary JavaScript execution in internal pages via Reader View JSON-LD injection | MEDIUM 5.4 | 0.2 % | ||
| CVE-2026-9308 | fixed in 151.2 | Arbitrary JavaScript execution in Reader View due to wrong HTML replacement order | MEDIUM 5.4 | 0.2 % | ||
| CVE-2026-9078 | fixed in 151.1 | Firefox iOS RTL Domain Rendering Issue in Link Preview | MEDIUM 5.4 | 0.2 % | ||
| CVE-2026-8706 | fixed in 151.0 | Sensitive user data could be leaked to other applications through Reader mode | MEDIUM 6.5 | 0.2 % | ||
| CVE-2026-2634 | fixed in 147.4 | Spoofed web content presented under trusted domains using scripted navigation on Firefox iOS | CRITICAL 9.8 | 0.4 % | ||
| CVE-2026-2032 | fixed in 147.2.1 | Interrupted page loads in new tabs could allow website spoofing under trusted domains in Firefox iOS | MEDIUM 4.3 | 0.2 % | ||
| CVE-2025-14744 | fixed in 144.0 | Filename spoofing via Unicode Right-to-Left Override in Firefox for iOS | MEDIUM 6.5 | 0.2 % | ||
| CVE-2025-10859 | fixed in 143.1 | Data stored in cookies for non-HTML content while browsing Incognito could be viewed after closing private tabs | MEDIUM 4.0 | 0.1 % | ||
| CVE-2025-55029 | fixed in 142 | Malicious scripts could spam popups for denial of service attacks | HIGH 7.5 | 0.3 % | ||
| CVE-2025-55031 | fixed in 142 | Passkey phishing within Bluetooth range | CRITICAL 9.8 | 0.4 % | ||
| CVE-2025-55028 | fixed in 142 | JavaScript alerts could impede UI interaction or allow denial of service attacks | MEDIUM 6.5 | 0.2 % | ||
| CVE-2025-55030 | fixed in 142 | Content-Disposition headers incorrectly ignored for some MIME types | MEDIUM 6.1 | 0.2 % | ||
| CVE-2025-54145 | fixed in 141 | Scanning a malicious URL utilizing Firefox's open-text scheme with the QR code scanner could load arbitrary websites | CRITICAL 9.1 | 0.4 % | ||
| CVE-2025-54144 | fixed in 141 | Internal Firefox open-text URL scheme allowed loading of arbitrary URLs | MEDIUM 5.4 | 0.2 % | ||
| CVE-2025-54143 | fixed in 141 | Sandboxed iframes could allow local downloads despite sandbox restrictions | CRITICAL 9.8 | 0.5 % | ||
| CVE-2025-5020 | fixed in 139 | Links using non-HTTP schemes opened from other apps such as Safari could have allowed spoofing of website addresses | MEDIUM 4.3 | 0.2 % | ||
| CVE-2025-27425 | fixed in 136 | QR code user confirmation bypass with invalid protocol | MEDIUM 4.3 | 0.2 % | ||
| CVE-2025-27424 | fixed in 136 | Firefox Mobile iOS Address Bar Spoof Using Server-Side Redirect to non-http Scheme | MEDIUM 4.3 | 0.3 % | ||
| CVE-2025-27426 | fixed in 136 | Firefox Mobile iOS Full Address Bar Spoof Using Server-Side Redirect to internal error page | MEDIUM 5.4 | 0.2 % | ||
| CVE-2025-23109 | fixed in 134 | Address bar spoofing on iOS using long hostnames | MEDIUM 6.5 | 0.2 % | ||
| CVE-2025-23108 | fixed in 134 | Firefox Mobile iOS Full Address Bar Spoof Using Open in New Tab and Javascript URI | MEDIUM 4.3 | 0.2 % | ||
| CVE-2024-53976 | unspecified – < 133 | Under certain circumstances, navigating to a webpage would result in the address missing from the location URL bar, making it unclear what t | MEDIUM 5.4 | 0.3 % | ||
| CVE-2024-53975 | unspecified – < 133 | Accessing a non-secure HTTP site that uses a non-existent port may cause the SSL padlock icon in the location URL bar to, misleadingly, appe | MEDIUM 5.4 | 0.3 % | ||
| CVE-2024-10004 | unspecified – < 131.2 | Opening an external link to an HTTP website when Firefox iOS was previously closed and had an HTTPS tab open could in some cases result in t | CRITICAL 9.1 | 0.4 % | ||
| CVE-2024-43111 | unspecified – < 129 | Long pressing on a download link could potentially allow Javascript commands to be executed within the browser This vulnerability affects Fi | CRITICAL 9.8 | 0.3 % | ||
| CVE-2024-43113 | unspecified – < 129 | The contextual menu for links could provide an opportunity for cross-site scripting attacks This vulnerability affects Firefox for iOS < 129 | MEDIUM 6.1 | 0.3 % | ||
| CVE-2024-43112 | unspecified – < 129 | Long pressing on a download link could potentially provide a means for cross-site scripting This vulnerability affects Firefox for iOS < 129 | MEDIUM 6.1 | 0.3 % | ||
| CVE-2024-38313 | unspecified – < 127 | In certain scenarios a malicious website could attempt to display a fake location URL bar which could mislead users as to the actual website | MEDIUM 4.3 | 0.2 % | ||
| CVE-2024-38312 | unspecified – < 127 | When browsing private tabs, some data related to location history or webpage thumbnails could be persisted incorrectly within the sandboxed | MEDIUM 6.5 | 0.3 % | ||
| CVE-2024-31393 | unspecified – < 124 | Dragging Javascript URLs to the address bar could cause them to be loaded, bypassing restrictions and security protections This vulnerabilit | MEDIUM 4.3 | 0.3 % | ||
| CVE-2024-31392 | unspecified – < 124 | If an insecure element was added to a page after a delay, Firefox would not replace the secure icon with a mixed content security status Thi | HIGH 7.5 | 0.4 % | ||
| CVE-2024-26281 | unspecified – < 123 | Upon scanning a JavaScript URI with the QR code scanner, an attacker could have executed unauthorized scripts on the current top origin site | MEDIUM 4.7 | 0.3 % | ||
| CVE-2024-26282 | unspecified – < 123 | Using an AMP url with a canonical element, an attacker could have executed JavaScript from an opened bookmarked page. This vulnerability aff | HIGH 7.1 | 0.3 % | ||
| CVE-2024-26283 | unspecified – < 123 | An attacker could have executed unauthorized scripts on top origin sites using a JavaScript URI when opening an external URL with a custom F | HIGH 7.8 | 0.3 % | ||
| CVE-2024-0953 | unspecified – < 129 | When a user scans a QR Code with the QR Code Scanner feature, the user is not prompted before being navigated to the page specified in the c | MEDIUM 6.1 | 0.3 % | ||
| CVE-2023-49061 | unspecified – < 120 | An attacker could have performed HTML template injection via Reader Mode and exfiltrated user information. This vulnerability affects Firefo | MEDIUM 6.1 | 0.3 % | ||
| CVE-2023-49060 | unspecified – < 120 | An attacker could have accessed internal pages or data by ex-filtrating a security key from ReaderMode via the `referrerpolicy` attribute. T | CRITICAL 9.8 | 0.6 % | ||
| CVE-2023-5758 | unspecified – < 119 | When opening a page in reader mode, the redirect URL could have caused attacker-controlled script to execute in a reflected Cross-Site Scrip | MEDIUM 6.1 | 0.5 % | ||
| CVE-2023-37456 | unspecified – < 115 | The session restore helper crashed whenever there was no parameter sent to the message handler. This vulnerability affects Firefox for iOS < | MEDIUM 6.5 | 0.5 % | ||
| CVE-2023-37455 | unspecified – < 115 | The permission request prompt from the site in the background tab was overlaid on top of the site in the foreground tab. This vulnerability | MEDIUM 5.4 | 0.3 % | ||
| CVE-2019-17003 | | Scanning a QR code that contained a javascript: URL would have resulted in the Javascript being executed. | MEDIUM 6.1 | 0.4 % | ||
| CVE-2022-31746 | unspecified – < 102 | Internal URLs are protected by a secret UUID key, which could have been leaked to web page through the Referrer header. This vulnerability a | MEDIUM 6.5 | 0.4 % | ||
| CVE-2022-1887 | unspecified – < 101 | The search term could have been specified externally to trigger SQL injection. This vulnerability affects Firefox for iOS < 101. | CRITICAL 9.8 | 0.6 % | ||
| CVE-2021-29958 | unspecified – < 34 | When a download was initiated, the client did not check whether it was in normal or private browsing mode, which led to private mode cookies | MEDIUM 4.3 | 0.7 % | ||
| CVE-2020-15651 | unspecified – < 28 | A unicode RTL order character in the downloaded file name can be used to change the file's name during the download UI flow to change the fi | MEDIUM 4.3 | 0.6 % | ||
| CVE-2020-15662 | unspecified – < 28 | A rogue webpage could override the injected WKUserScript used by the download feature, this exploit could result in the user downloading an | MEDIUM 6.5 | 0.7 % | ||
| CVE-2020-15661 | unspecified – < 28 | A rogue webpage could override the injected WKUserScript used by the logins autofill, this exploit could result in leaking a password for th | MEDIUM 6.5 | 0.9 % | ||
| CVE-2020-12414 | unspecified – < 27 | IndexedDB should be cleared when leaving private browsing mode and it is not, the API for WKWebViewConfiguration was being used incorrectly | MEDIUM 6.5 | 0.7 % | ||
| CVE-2020-12404 | unspecified – < 26 | For native-to-JS bridging the app requires a unique token to be passed that ensures non-app code can't call the bridging functions. That tok | MEDIUM 4.3 | 0.8 % | ||
| CVE-2020-6830 | unspecified – < 25 | For native-to-JS bridging, the app requires a unique token to be passed that ensures non-app code can't call the bridging functions. That to | HIGH 7.5 | 0.9 % |