CVE-2026-103417: Mozilla Firefox For IOS

Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days.

Firefox for iOS could autofill saved credentials into a new page if cross-origin navigation occurred while the saved-login UI was open. Autofill was not bound to the originating page or rejected when its origin changed. This vulnerability was fixed in Firefox for iOS 157.1.

Affected products

• Mozilla Firefox For IOS

Published 2026-10-13. Last modified 2026-10-13.