CVE-2026-103418: Mozilla Firefox For IOS

High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days.

Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in Firefox’s privileged content world and bypass the page’s Content Security Policy. This vulnerability was fixed in Firefox for iOS 157.1.

Affected products

• Mozilla Firefox For IOS

Published 2026-10-13. Last modified 2026-10-14.