Mozilla Firefox Mobile vulnerabilities

CVE-2026-86853 Medium · 4.3 CWE-451 Sep 8, 2026

A malicious webpage could repeatedly trigger external URL schemes, causing system…

A malicious webpage could repeatedly trigger external URL schemes, causing system prompts or external application launches. This could make Firefox for iOS temporarily unusable until the page is closed. This vulnerability was fixed in Firefox for iOS 155.1.

CVE-2026-84135 Critical · 9.8 CWE-20 Sep 1, 2026

Improper Input Validation in Mozilla Firefox Mobile

Other issue in Firefox Focus for Android. This vulnerability was fixed in Firefox 155.

CVE-2026-84127 Medium · 4.3 CWE-200 Sep 1, 2026

Exposure of Sensitive Information in Mozilla Firefox Mobile

Information disclosure in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 155.

CVE-2026-84117 High · 8.8 CWE-284 Sep 1, 2026

Improper Access Control in Mozilla Firefox Mobile

Privilege escalation in Firefox for Android. This vulnerability was fixed in Firefox 155.

CVE-2026-81267 Medium · 5.4 CWE-451 Aug 31, 2026

A malicious webpage could stall a popup's cross-origin navigation after commit, causing…

A malicious webpage could stall a popup's cross-origin navigation after commit, causing the address bar to display the destination origin while continuing to render attacker-controlled content. This vulnerability was fixed in Firefox for iOS 155.0.

CVE-2026-74980 Medium · 6.5 CWE-1021 Aug 18, 2026

Clickjacking in Mozilla Firefox Mobile

Clickjacking issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154.

CVE-2026-74975 Medium · 5.4 CWE-451 Aug 18, 2026

Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was…

Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154.

CVE-2026-74951 Medium · 6.5 CWE-1021 Aug 18, 2026

Clickjacking in Mozilla Firefox Mobile

Clickjacking issue in Firefox for Android. This vulnerability was fixed in Firefox 154.

CVE-2026-16404 High · 7.4 CWE-290 Jul 21, 2026

Spoofing issue in Firefox for Android

Spoofing issue in Firefox for Android. This vulnerability was fixed in Firefox 153.

CVE-2026-16373 High · 7.5 CWE-200 Jul 21, 2026

Information disclosure in the Privacy component in Firefox for Android

Information disclosure in the Privacy component in Firefox for Android. This vulnerability was fixed in Firefox 153.

CVE-2026-14906 Medium · 5.3 CWE-434 Jul 13, 2026

Malicious webpage titles could allow overwriting of bundled PDF resources when saving webpages as PDFs in Firefox for iOS

Pages with malicious titles could potentially allow saved PDF content to overwrite PDF files or bundled content within the Firefox for iOS application sandbox. This vulnerability was fixed in Firefox for iOS 152.4.

CVE-2026-53900 Medium · 4.3 CWE-345 Jun 16, 2026

Cookie injection was possible when opening a PDF link

Firefox for iOS preserved cookies set on the initial PDF request across cross-origin HTTP redirects in TemporaryDocument, allowing a malicious site to inject arbitrary cookies into requests to an unrelated target domain. This vulnerability was fixed in Firefox for iOS 152.0.

CVE-2026-53899 Medium · 6.5 CWE-345 Jun 16, 2026

Cross-origin cookies could be leaked when opening a PDF link

Firefox for iOS used partial domain matching when attaching cookies to PDF requests, allowing a malicious site on a suffix domain to receive cookies belonging to the target site. This vulnerability was fixed in Firefox for iOS 152.0.

CVE-2022-26485 High · 8.8 KEV High · 61 Public exploit CWE-416 Dec 22, 2022

Mozilla Firefox Use-After-Free Vulnerability

Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.

CVE-2022-26486 Critical · 9.6 KEV High · 58 CWE-416 Dec 22, 2022

Mozilla Firefox Use-After-Free Vulnerability

An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.