Is CVE-2026-103418 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-103418 being exploited in the wild.

How severe is CVE-2026-103418?

High severity, with a CVSS score of 8.8, published 13 October 2026.

Which products and versions are affected?

Mozilla Firefox for iOS before 157.1.

Is there a fix for CVE-2026-103418?

Yes: fixed in Firefox for iOS 157.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-103418 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-103418?

Check whether you run Mozilla Firefox for iOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-103418: Firefox for iOS XSS via HTML language attribute in Translation Services

CVE-2026-103418 · Severity: high · CVSS 8.8 · Published 2026-10-13

Firefox for iOS contains a cross-site scripting vulnerability in its translation feature where attacker-controlled HTML language attributes are directly executed as code. An attacker can exploit this to steal user data, hijack sessions, or perform actions on behalf of the user, bypassing Firefox's security protections in the process.

Technologies: Mozilla Firefox for iOS. Vendors: Mozilla.

Quick answers

Is CVE-2026-103418 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-103418 being exploited in the wild.
How severe is CVE-2026-103418?: High severity, with a CVSS score of 8.8, published 13 October 2026.
Which products and versions are affected?: Mozilla Firefox for iOS before 157.1.
Is there a fix for CVE-2026-103418?: Yes: fixed in Firefox for iOS 157.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-103418 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-103418?: Check whether you run Mozilla Firefox for iOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Firefox for iOS 157.1

Technical details

Firefox for iOS directly interpolates the page's HTML language attribute into translation JavaScript without proper sanitization, enabling universal XSS (UXSS) that executes arbitrary code in Firefox's privileged content world. This allows attackers to bypass Content Security Policy restrictions on attacker-controlled pages and execute malicious JavaScript with elevated privileges.

Affected products

Mozilla Firefox for iOS before 157.1

Timeline

2026-10-05: disclosed
2026-10-05: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.