CVE-2026-81267: Mozilla Firefox Mobile

Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days.

A malicious webpage could stall a popup's cross-origin navigation after commit, causing the address bar to display the destination origin while continuing to render attacker-controlled content. This vulnerability was fixed in Firefox for iOS 155.0.

Affected products

• Mozilla Firefox Mobile: before 155.0 (fixed in 155.0)

Published 2026-08-31. Last modified 2026-09-03.