Vulnerability in Mozilla Firefox for iOS

[ Description ]Official description

Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in Firefox’s privileged content world and bypass the page’s Content Security Policy. This vulnerability was fixed in Firefox for iOS 157.1.

[ Fixes ]Fixes and patches

• Security bulletin: Mozilla mfsa2026-105Vendor patch or bulletin · CERT-FR · mozilla.org/en-US/security/advisories/mfsa2026-105, cited by CERT-FR CERTFR-2026-AVI-1297

[ Advisories ]Government CERT advisories

• CERT-FR13 Oct 2026CERTFR-2026-AVI-1297

  Multiple vulnerabilities in Mozilla Firefox Translated from French

  Multiple vulnerabilities have been discovered in Mozilla Firefox. They allow an attacker to cause remote cross-site scripting (XSS) and a security policy bypass.

  CVE-2026-103417CVE-2026-103418
• BSI CERT-Bund12 Oct 2026WID-SEC-2026-3879

  Mozilla Firefox iOS: Multiple vulnerabilities Translated from German

  CVE-2026-103418CVE-2026-103417

[ References ]References

• bugzilla.mozilla.org/show_bug.cgi
• www.mozilla.org/security/advisories/mfsa2026-105