EUVD-2026-68739
GHSA-pp56-4328-qwfp
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Network-delivered spoofing via a web page, requiring user interaction; confidentiality limited to UI deception enabling phishing, no integrity impact, availability limited to navigation stalling.
Primary rating from Vendor (mozilla).
CVSS VectorVendor: mozilla
Lifecycle Timeline
4DescriptionCVE.org
A malicious webpage could stall a popup's cross-origin navigation after commit, causing the address bar to display the destination origin while continuing to render attacker-controlled content. This vulnerability was fixed in Firefox for iOS 155.0.
AnalysisAI
Address bar spoofing in Firefox for iOS lets a malicious webpage stall a popup's cross-origin navigation after the browser internally commits it, causing the address bar to display the intended destination's origin while the popup continues rendering attacker-controlled content. All Firefox for iOS releases prior to 155.0 are affected; the fix shipped in version 155.0 per Mozilla advisory MFSA2026-81. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to be running Firefox for iOS on any version prior to 155.0 and to visit a malicious webpage that programmatically initiates a cross-origin popup navigation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.4 Medium score accurately captures the limited scope: AV:N and AC:L indicate the attack is straightforward to mount from any web origin, but UI:R and S:U impose meaningful constraints - the victim must actively visit the malicious page and encounter the popup flow, and the impact is confined to the browser's own session. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: Firefox for iOS 155.0. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Firefox For Ios
View allFirefox for iOS Reader mode exposed an unauthenticated local HTTP server on the device, enabling a co-installed maliciou
Cookie leakage in Firefox for iOS prior to 152.0 allows an attacker-controlled suffix domain to intercept cookies intend
Cross-site scripting in Firefox for iOS Reader View allows unauthenticated remote attackers to inject arbitrary markup v
Reader View in Firefox for iOS executes arbitrary JavaScript due to an incorrect template substitution order, enabling c
Firefox for iOS misrepresents attacker-controlled domains as trusted origins through improper rendering of right-to-left
PDF save functionality in Firefox for iOS allows maliciously crafted page titles to manipulate the output file path, ena
Repeated external URL scheme invocations from a malicious webpage can flood Firefox for iOS with system confirmation pro
Cookie injection in Firefox for iOS (all versions prior to 152.0) arises from the browser's TemporaryDocument PDF handli
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today