EUVD-2026-98340
GHSA-6fqq-f23v-gqfc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure user to trigger saved-login UI
-
ExploitInduce cross-origin navigation mid-autofill
-
ExecutionAutofill binds to wrong origin
-
ImpactCredentials disclosed to attacker page
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Origin validation
|
| Exploitation Conditions | Exploitation requires that the Firefox for iOS saved-login/autofill UI be open AND that a cross-origin navigation occur during that window, because autofill was not bound to the originating page or re-validated when the origin changed. Limiting factors: it is iOS-specific (Firefox for iOS only), requires active user interaction (UI:R) to invoke the login prompt, depends on a narrow timing/navigation race rather than a stable condition, and is fully remediated in version 157.1. It does not work against patched clients or when the saved-login UI is not actively engaged. |
| Impact | Signals point to a low-to-moderate, non-urgent issue. SSVC is unambiguous and consistent: Exploitation=none, Automatable=no, Technical Impact=partial - i.e. no observed exploitation and not scalable. No CISA KEV listing and no public POC were provided, and no EPSS score was supplied (missing data, not zero risk). The Mozilla CVSS of 5.5 (MEDIUM) reflects a credential-disclosure flaw with Confidentiality:High but no Integrity/Availability impact. There is a notable internal tension worth flagging: the CVSS vector is AV:L (local attack vector) with UI:R, yet the described mechanism - autofill leaking into a page reached via cross-origin web navigation - reads like a network/web-delivered attack (AV:N) requiring a specific timing window (saved-login UI open during navigation). This AV:L-vs-web-attack mismatch should be verified with Mozilla; Mozilla frequently rates mobile-browser issues conservatively. Overall this is a legitimate but lower-priority browser hardening fix, not a widespread-exploitation emergency. |
| Exploit ScenarioDerived | A user opens Firefox for iOS and triggers the saved-login/autofill UI on a trusted site; a malicious or attacker-influenced page causes a cross-origin navigation while that UI is still open, and the browser autofills the saved credentials into the attacker-controlled destination instead of the original origin, disclosing the username/password. The attack requires user interaction (UI:R) and a specific race-like window, and no public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Information disclosure in Mozilla Firefox for iOS (releases prior to 157.1) can leak saved credentials to a different origin: if a cross-origin navigation occurs while the saved-login/autofill UI is open, the browser may still fill the stored username and password into the newly loaded page, because the autofill action was never bound to the page that originally requested it and was not re-validated when the origin changed (CWE-346). Exploitation requires the user to have triggered the login prompt (UI:R) and depends on a narrow race between that prompt being open and the navigation occurring, so our independent assessment rates it as a network-reachable but high-complexity, unauthenticated issue with confidentiality-only impact (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N). No public exploit code has been identified at time of analysis, CISA's SSVC framework records exploitation as 'none' and the issue as not automatable, and Mozilla shipped the fix in Firefox for iOS 157.1.
RemediationAI
Vendor-released patch: Firefox for iOS 157.1 - upgrade to 157.1 or later via the App Store and confirm the installed version, as this is the only complete fix and no backport or configuration workaround fully closes the origin-binding defect. Because the CPE shows an unbounded version range, verify the build number rather than assuming a recent-looking install is patched, and enable automatic app updates on managed iOS fleets. Until the upgrade is deployed, the practical compensating control is to disable saved-password autofill in Firefox for iOS (Settings → Logins and Passwords, turning off autofill for saved logins) and to rely on a separate password manager or manual entry; the trade-off is reduced convenience and manual typing, and it is only a partial mitigation if any other autofill path remains enabled, so it should be treated as temporary. Secondary hygiene measures - avoid leaving the saved-login prompt open while following links, and avoid navigating to untrusted or redirected pages from that state - reduce exposure to the race but cannot be enforced programmatically. Full details and version confirmation are in Mozilla's advisory at https://www.mozilla.org/security/advisories/mfsa2026-105/ and the upstream bug at https://bugzilla.mozilla.org/show_bug.cgi?id=2068171. No vendor-released workaround short of upgrading is documented, and our release priority remains low-to-moderate given SSVC exploitation 'none', no public exploit code, and the narrow user-interaction-dependent race conditions required.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-346, Origin Validation Error: the credential autofill subsystem in Firefox for iOS was not scoped to the origin that initiated the saved-login request, and it did not re-check or discard the pending fill when the browsing context navigated to a different origin. Correct implementations bind a pending credential fill to the requesting document/origin and abort it on any origin change; here the fill survived navigation, so a page from an unrelated origin could receive the stored credentials. The affected component is the platform-specific (iOS) saved-login/autofill UI rather than a general web-rendering engine flaw, which is why the CPE scope is limited to cpe:2.3:a:mozilla:firefox_for_ios:*:*:*:*:*:*:*:* and why the advisory is tracked solely under Mozilla's Firefox for iOS channel (MFSA 2026-105) alongside Bugzilla 2068171. The vector PR:N/UI:R indicates the attacker does not need credentials on the target device, but a user must actively open the saved-login prompt, and the assessed AV:N/AC:H/S:C reflects that the attack is deliverable over the network (e.g., a page or redirect that triggers navigation) yet depends on a difficult-to-hit timing condition with impact confined to confidentiality.
Know when Firefox For Ios gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Web-delivered cross-origin navigation implies AV:N (contra vendor AV:L); the timing window gives AC:H, user must invoke autofill (UI:R), credentials cross origins (S:C), only confidentiality impacted (C:H).
Primary rating from Vendor (mozilla).
CVSS VectorVendor: mozilla
Lifecycle Timeline
3DescriptionCVE.org
Firefox for iOS could autofill saved credentials into a new page if cross-origin navigation occurred while the saved-login UI was open. Autofill was not bound to the originating page or rejected when its origin changed. This vulnerability was fixed in Firefox for iOS 157.1.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)CVE.org
More in Firefox For Ios
View allFirefox for iOS versions prior to 157.1 interpolate a page's HTML lang attribute directly into the browser's translation
Firefox for iOS Reader mode exposed an unauthenticated local HTTP server on the device, enabling a co-installed maliciou
Cookie leakage in Firefox for iOS prior to 152.0 allows an attacker-controlled suffix domain to intercept cookies intend
Address bar spoofing in Firefox for iOS lets a malicious webpage stall a popup's cross-origin navigation after the brows
Cross-site scripting in Firefox for iOS Reader View allows unauthenticated remote attackers to inject arbitrary markup v
Reader View in Firefox for iOS executes arbitrary JavaScript due to an incorrect template substitution order, enabling c
Firefox for iOS misrepresents attacker-controlled domains as trusted origins through improper rendering of right-to-left
PDF save functionality in Firefox for iOS allows maliciously crafted page titles to manipulate the output file path, ena
Repeated external URL scheme invocations from a malicious webpage can flood Firefox for iOS with system confirmation pro
Cookie injection in Firefox for iOS (all versions prior to 152.0) arises from the browser's TemporaryDocument PDF handli
Exploit-DB