What is the CVSS score of CVE-2026-9309?

CVE-2026-9309 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Firefox for iOS CVE-2026-9309

EUVD-2026-33630 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-01 mozilla

GHSA-29fm-4hpp-5p7g

XSS Mozilla Apple

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 01, 2026 - 15:26 vuln.today

CVSS changed

Jun 01, 2026 - 15:22 NVD

5.4 (MEDIUM)

CVE Published

Jun 01, 2026 - 11:24 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 01, 2026 - 11:24 nvd

MEDIUM 5.4

DescriptionCVE.org

Firefox for iOS Reader View did not properly escape HTML tags in JSON-LD metadata. A malicious page could inject markup that changed Reader View behavior and leaked sensitive URL parameters. These parameters could then be used to access internal pages, potentially resulting in arbitrary JavaScript execution in an internal origin. This vulnerability was fixed in Firefox for iOS 151.2.

AnalysisAI

Cross-site scripting in Firefox for iOS Reader View allows unauthenticated remote attackers to inject arbitrary markup via maliciously crafted JSON-LD metadata on attacker-controlled pages. When a victim activates Reader View on such a page, injected HTML executes in the context of an internal Firefox origin, leaking sensitive URL parameters that can be leveraged to access internal pages and achieve arbitrary JavaScript execution with elevated browser-origin trust. Mozilla patched this in Firefox for iOS 151.2 per MFSA2026-53; no public exploit code and no CISA KEV listing have been identified at time of analysis.

Technical ContextAI

Firefox for iOS provides a Reader View mode that parses JSON-LD structured data - a semantic web standard embedded via <script type='application/ld+json'> tags - to extract and display page metadata in a distraction-free layout. CWE-79 (Improper Neutralization of Input During Web Page Generation / Cross-Site Scripting) identifies the root cause: the Reader View rendering pipeline failed to HTML-escape tags present within JSON-LD metadata values before injecting them into the Reader View DOM, allowing attacker-supplied JSON-LD fields to break out of their expected text context and introduce executable markup. Because Reader View operates under an internal Firefox origin rather than the originating page's origin, any script execution occurs in a privileged browser-controlled context that may have broader access than ordinary web content. The affected software is identified by CPE cpe:2.3:a:mozilla:firefox_for_ios:*:*:*:*:*:*:*:*, covering all Firefox for iOS versions prior to the fix.

RemediationAI

The primary fix is to upgrade Firefox for iOS to version 151.2 or later, as confirmed by Mozilla Security Advisory MFSA2026-53 (https://www.mozilla.org/security/advisories/mfsa2026-53/) and the associated Bugzilla report (https://bugzilla.mozilla.org/show_bug.cgi?id=2036573). Users should apply the update via the Apple App Store. As an interim compensating control pending update, users should avoid activating Reader View on any untrusted or externally-sourced web pages, since Reader View must be manually invoked and is not enabled by default - disabling this user habit entirely eliminates the attack surface with no functional trade-off for security-sensitive browsing. Mobile device management (MDM) administrators managing enterprise iOS fleets should enforce the Firefox for iOS version requirement via app version compliance policies. No server-side mitigations are available to defenders, as the vulnerability is entirely client-side.