What is the CVSS score of CVE-2026-9308?

CVE-2026-9308 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Firefox for iOS CVE-2026-9308

EUVD-2026-33629 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-01 mozilla

GHSA-h55j-6jm9-f8vp

XSS Mozilla Apple

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 01, 2026 - 15:26 vuln.today

CVSS changed

Jun 01, 2026 - 15:22 NVD

5.4 (MEDIUM)

CVE Published

Jun 01, 2026 - 11:24 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 01, 2026 - 11:24 nvd

MEDIUM 5.4

DescriptionCVE.org

Firefox for iOS Reader View replaced page content in its HTML template before replacing other internal placeholders. A malicious page could include a placeholder string that was later substituted with JSON-LD data, potentially resulting in arbitrary JavaScript execution. This vulnerability was fixed in Firefox for iOS 151.2.

AnalysisAI

Reader View in Firefox for iOS executes arbitrary JavaScript due to an incorrect template substitution order, enabling cross-site scripting via JSON-LD data injection. The flaw affects all Firefox for iOS versions prior to 151.2 running on Apple iOS devices; unauthenticated remote attackers can exploit this by luring users to a malicious page and having them activate Reader View, after which attacker-controlled placeholder strings embedded in the page's structured data are processed as executable script. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low attack complexity and no-auth-required access vector (per CVSS PR:N) make it feasible for opportunistic campaigns targeting iOS Firefox users.

Technical ContextAI

Firefox for iOS implements a Reader View feature that reformats web pages into a clean reading layout using an internal HTML template engine. The root cause (CWE-79: Improper Neutralization of Input During Web Page Generation - XSS) is a substitution-order bug: the template engine injected raw page HTML content into the template before resolving its own internal placeholder tokens (including those reserved for JSON-LD structured data). A malicious page could therefore embed strings that matched internal placeholder patterns; when the template engine performed its second-pass substitution to populate JSON-LD data, it would process the attacker-supplied string as a legitimate template directive, injecting attacker-controlled content as JavaScript into the rendered Reader View document. The affected component is exclusively the Mozilla Firefox for iOS application (CPE: cpe:2.3:a:mozilla:firefox_for_ios:*:*:*:*:*:*:*:*) and does not affect desktop Firefox or Firefox for Android.

RemediationAI

Vendor-released patch: Firefox for iOS 151.2. Users should update Firefox for iOS to version 151.2 or later via the Apple App Store immediately, as confirmed by Mozilla Security Advisory MFSA2026-53 (https://www.mozilla.org/security/advisories/mfsa2026-53/). As a temporary workaround prior to patching, users can avoid activating Reader View on untrusted or unfamiliar web pages, which eliminates the exploitation path since the vulnerability is only triggered by Reader View rendering. Note that this workaround removes Reader View functionality entirely for untrusted content and is not a substitute for patching. Enterprise or MDM-managed iOS environments should push the app update via managed distribution channels. No server-side or network-level mitigations are applicable since the vulnerability resides entirely within the client-side browser application.