# CVE-2026-13356: Mozilla Firefox for iOS address bar origin spoofing

Source: https://junglewise.ai/threats/cve-2026-13356-mozilla-firefox-for-ios-address-bar-origin-spoofing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-07. Updated: 2026-07-07  
License: CC BY 4.0 with a link back

CVE-2026-13356 · Severity: info · CVSS 0 · Published 2026-07-07

A security flaw in Firefox for iOS allows a malicious website to trick users by displaying a fake web address in the browser's address bar. While the address bar shows a legitimate site, the browser continues to display content controlled by the attacker. This could be used in phishing attacks to steal login credentials or sensitive information by making a fraudulent site appear trustworthy.

Technologies: [Mozilla Firefox for iOS](https://junglewise.ai/threats/technologies/firefox-for-ios). Vendors: [Mozilla](https://junglewise.ai/threats/vendors/mozilla).

## Quick answers

**Is CVE-2026-13356 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-13356 being exploited in the wild.

**How severe is CVE-2026-13356?** Informational severity, with a CVSS score of 0, published 7 July 2026.

**Which products and versions are affected?** Mozilla Firefox for iOS < 152.3.

**Is there a fix for CVE-2026-13356?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-13356 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-13356?** Check whether you run Mozilla Firefox for iOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An address bar spoofing vulnerability exists in Firefox for iOS due to improper handling of synchronous JavaScript dialogs during navigation. By enqueuing a dialog (such as an alert or prompt) at the moment a user navigates to a new site, an attacker can interrupt the transition process. This results in a state where the browser updates the URL bar to the new destination origin while the rendering engine remains on the attacker's page. This allows for sophisticated phishing attacks where the user believes they are on a trusted domain. The issue is resolved in Firefox for iOS version 152.3.

## Affected products

- Mozilla Firefox for iOS < 152.3

## Timeline

- 2026-07-05: advisory: Mozilla Foundation Security Advisory 2026-65 released
- 2026-07-07: disclosed: CVE-2026-13356 published to NVD

## References

- [https://bugzilla.mozilla.org/show_bug.cgi?id=2047768](https://bugzilla.mozilla.org/show_bug.cgi?id=2047768)
- [https://www.mozilla.org/security/advisories/mfsa2026-65/](https://www.mozilla.org/security/advisories/mfsa2026-65/)

## Related threats

- [Mozilla Firefox for iOS privilege escalation](https://junglewise.ai/threats/cve-2026-121843-privilege-escalation-in-firefox-for-ios-this-vulnerability-was)
- [Mozilla Firefox for iOS privilege escalation in Reader View](https://junglewise.ai/threats/cve-2026-121842-privilege-escalation-in-the-reader-view-component-in-firefox-for)
- [Firefox for iOS information disclosure](https://junglewise.ai/threats/cve-2026-121841-other-issue-in-firefox-for-ios-this-vulnerability-was-fixed-in)
- [Firefox for iOS FaceTime protocol handler spoofing](https://junglewise.ai/threats/cve-2026-116632-a-malicious-web-page-could-insert-arbitrary-text-into-the)
- [Firefox for iOS external protocol handler spoofing via tel link](https://junglewise.ai/threats/cve-2026-116631-a-malicious-web-page-could-open-a-tel-link-in-a-window-that-was)