Firefox for iOS CVE-2026-103418

Exploitation requires the victim to open an attacker-controlled (or compromised) page in Firefox for iOS whose HTML lang attribute carries crafted markup, AND for the browser's page-translation feature to process that page - the translation code path is what interpolates the attacker's language attribute into executing JavaScript. Limiting factors: user interaction is required (UI:R - the victim must visit the page and the translation feature must be invoked), exploitation is not automatable per SSVC, and only Firefox for iOS versions prior to 157.1 are affected. No authentication is required (PR:N), so visitors need no account on the malicious site.

Signals are mixed, pointing to a genuine but non-emergency priority. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R) reflects a serious client-side flaw: network-reachable, low complexity, no privileges needed, with high confidentiality, integrity and availability impact - consistent with code execution in Firefox's privileged content world and a Content Security Policy bypass. However, CISA's SSVC decision framework tempers this: Exploitation=none (no observed or public exploitation), Automatable=no (each victim must be individually lured and must trigger translation, so it cannot be mass-sprayed), while Technical Impact=total aligns with the C:H/I:H/A:H rating. EPSS exploitation-probability data was NOT provided, so likelihood of near-term weaponization cannot be quantified from the input. The CVE is NOT in CISA KEV and no POC is referenced, so there is no public exploit identified at time of analysis. Net: a legitimately high-severity bug worth prompt patching, but the mandatory user interaction (UI:R), lack of automatability, and absence of any exploitation evidence make it a scheduled-patch item rather than a drop-everything incident. The single conflicting factor is scope: Mozilla rated S:U, yet the described escape from page context into Firefox's privileged world and CSP bypass arguably crosses a security authority (see assessed vector) - verify scope interpretation with the vendor advisory.

An attacker hosts or compromises a web page and sets a malicious HTML language attribute containing crafted markup. When a Firefox for iOS user visits the page and the translation feature processes it, the attacker's markup is interpolated into translation JavaScript and runs in Firefox's privileged content world, bypassing the page's CSP to steal data or manipulate content across the browsing session. No public exploit code is identified at time of analysis, and the attack requires the victim to visit the page and have translation triggered (UI:R).