Quick answers
- Is CVE-2026-81267 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-81267 being exploited in the wild.
- How severe is CVE-2026-81267?
- Medium severity, with a CVSS score of 5.4, published 31 August 2026.
- Which products and versions are affected?
- Mozilla Firefox for iOS before 155.0.
- Is there a fix for CVE-2026-81267?
- A patch was published on 2026-08-31: Fixed in Firefox for iOS 155.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-81267 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-81267?
- Check whether you run Mozilla Firefox for iOS or Mozilla Firefox Mobile at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a UI spoofing / address bar spoofing vulnerability affecting Firefox for iOS. The root cause is a race condition or logic flaw in the popup navigation commit process, where a malicious webpage can stall cross-origin navigation after it has been committed to the browser's address bar but before the content has actually been replaced. This allows the attacker's content to persist on-screen while the address bar reflects the destination origin, creating a convincing phishing surface. The attack requires a malicious webpage initiating or controlling the popup, but no user authentication is needed beyond visiting the malicious page. An attacker gains the ability to perform address bar spoofing, enabling phishing, credential theft, and social engineering attacks. The vulnerability was fixed in Firefox for iOS 155.0, released August 31, 2026.
Affected products
- Mozilla Firefox for iOS before 155.0
Timeline
- 2026-08-31: disclosed
- 2026-08-31: patched: Fixed in Firefox for iOS 155.0