Firefox for iOS
CVE-2026-14906
MEDIUM
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
User must actively save PDF (UI:R); overwrite affects integrity and availability within sandbox, not confidentiality.
Primary rating from Vendor (mozilla).
CVSS VectorVendor: mozilla
Lifecycle Timeline
4DescriptionCVE.org
Pages with malicious titles could potentially allow saved PDF content to overwrite PDF files or bundled content within the Firefox for iOS application sandbox. This vulnerability was fixed in Firefox for iOS 152.4.
AnalysisAI
PDF save functionality in Firefox for iOS allows maliciously crafted page titles to manipulate the output file path, enabling overwrites of existing PDF files or bundled application content within the Firefox iOS sandbox. All versions prior to 152.4 on Apple iOS devices are affected. An attacker operating a malicious website can lure a user into saving a page as PDF, causing the crafted title to resolve to an unintended file path within the app sandbox - potentially corrupting application state or stored documents. No public exploit has been identified at time of analysis, though SSVC classifies the vulnerability as automatable with partial technical impact.
Technical ContextAI
The vulnerability resides in Firefox for iOS (cpe:2.3:a:mozilla:firefox_for_ios:*:*:*:*:*:*:*:*), Mozilla's WebKit-based browser for Apple's iOS platform. When a user saves a web page as PDF, Firefox for iOS uses the page title as part of the output filename. Insufficient sanitization of that title - which is attacker-controlled via the HTML <title> element - allows path traversal or filename injection characters to redirect the written file to an unintended path within the application sandbox. The assigned CWE is CWE-434 (Unrestricted Upload of File with Dangerous Type), though the root cause is more precisely improper neutralization of special elements used in a filesystem path (cf. CWE-22 path traversal). The impact is bounded by the iOS app sandbox model, preventing escape to the broader device filesystem, but allows overwrite of co-located PDF documents or bundled application resources.
RemediationAI
Vendor-released patch: Firefox for iOS 152.4. Users should update Firefox for iOS to version 152.4 or later via the Apple App Store. The Mozilla advisory MFSA2026-66 (https://www.mozilla.org/security/advisories/mfsa2026-66/) confirms this as the primary fix. As a compensating control for environments where immediate update is not possible, administrators managing iOS device fleets via MDM can restrict or disable the 'Save as PDF' share action for Firefox through application management policies - this removes the trigger condition entirely, though it also eliminates the legitimate functionality. Alternatively, user awareness guidance to avoid saving pages as PDF from untrusted sites is a low-friction interim measure with no technical side effects.
More in Firefox For Ios
View allFirefox for iOS Reader mode exposed an unauthenticated local HTTP server on the device, enabling a co-installed maliciou
Cookie leakage in Firefox for iOS prior to 152.0 allows an attacker-controlled suffix domain to intercept cookies intend
Address bar spoofing in Firefox for iOS lets a malicious webpage stall a popup's cross-origin navigation after the brows
Cross-site scripting in Firefox for iOS Reader View allows unauthenticated remote attackers to inject arbitrary markup v
Reader View in Firefox for iOS executes arbitrary JavaScript due to an incorrect template substitution order, enabling c
Firefox for iOS misrepresents attacker-controlled domains as trusted origins through improper rendering of right-to-left
Repeated external URL scheme invocations from a malicious webpage can flood Firefox for iOS with system confirmation pro
Cookie injection in Firefox for iOS (all versions prior to 152.0) arises from the browser's TemporaryDocument PDF handli
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today