Firefox for iOS CVE-2026-116631

Exploitation requires the attacker to get a victim to load a malicious web page in Firefox for iOS and then interact with (confirm) the resulting phone-call prompt - user interaction is mandatory (UI:R). The specific condition is navigation/window handling where a 'tel:' link is opened in a window still showing a different website, causing misattribution of the call prompt's origin. Limiting factors: success depends on the victim trusting the spoofed site and accepting the dial prompt, it is confined to the Firefox for iOS browser prior to version 156.1, and there is no code execution or silent action - the user must actively approve the call, which substantially narrows realistic impact.

This is a moderate-severity UI spoofing flaw (CWE-451) in Firefox for iOS where a malicious page can open a 'tel:' link in a window still displaying a different site, making the phone-call prompt appear to originate from the trusted site. The input CVSS of 5.4 (AV:N/AC:L/PR:N/UI:R) indicates network-reachable, low-complexity, unauthenticated exploitation but requires user interaction. All real-world exploitation signals point low: EPSS is 0.21% (11th percentile), the SSVC framework records Exploitation=none, Automatable=no, and Technical Impact=partial, and there is no CISA KEV listing and no public exploit identified. The vuln.today priority label is 'this_month' rather than act_now/emergency, consistent with these signals. The impact is social-engineering/deception rather than code execution or data theft - the worst case is tricking a user into placing a phone call they believe a trusted site requested. One mild inconsistency: the supplied CVSS assigns C:L and A:L, yet the described mechanism is pure UI spoofing with no clear confidentiality read or availability loss, so those sub-scores appear generous relative to the description. Net: a legitimate low-to-moderate priority fix, not an urgent emergency.

A user visits a malicious web page while another trusted site is displayed in an adjacent or recently-navigated window; the malicious page triggers a 'tel:' link so the phone-call confirmation prompt appears attributed to the trusted site. The victim, believing the reputable site initiated it, confirms and dials an attacker-chosen number (e.g., a premium-rate or social-engineering line). No public exploit code has been identified; exploitation requires user interaction (UI:R) and depends on the victim trusting the spoofed origin.