# CVE-2026-86853: Mozilla Firefox for iOS denial of service via URL schemes

Source: https://junglewise.ai/threats/cve-2026-86853-mozilla-firefox-for-ios-denial-of-service-via-url-schemes  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-08. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86853 · Severity: medium · CVSS 4.3 · Published 2026-09-08

A malicious website could repeatedly launch system prompts or external apps on an iOS device running Firefox, making the browser temporarily unusable until the user closes the webpage. While the impact is temporary and the browser remains functional once the page is closed, this could disrupt user workflow and frustrate legitimate browsing sessions.

Technologies: [Mozilla Firefox for iOS](https://junglewise.ai/threats/technologies/firefox-for-ios). Vendors: [Mozilla](https://junglewise.ai/threats/vendors/mozilla).

## Quick answers

**Is CVE-2026-86853 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86853 being exploited in the wild.

**How severe is CVE-2026-86853?** Medium severity, with a CVSS score of 4.3, published 8 September 2026.

**Which products and versions are affected?** Mozilla Firefox for iOS before 155.1.

**Is there a fix for CVE-2026-86853?** A patch was published on 2026-09-08: Fixed in Firefox for iOS 155.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86853 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-86853?** Check whether you run Mozilla Firefox for iOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Firefox for iOS fails to properly throttle or block repeated invocations of external URL schemes from a loaded webpage. An attacker can craft a malicious HTML page that programmatically triggers system URL schemes (such as tel:, sms:, or app-specific schemes) in rapid succession, causing iOS to display multiple system prompts or launch external applications repeatedly. This denial-of-service condition persists while the malicious page is active in the browser, rendering Firefox temporarily unresponsive to user input. The vulnerability was fixed in Firefox for iOS 155.1 by implementing rate-limiting or blocking mechanisms for external URL scheme launches.

## Affected products

- Mozilla Firefox for iOS before 155.1

## Timeline

- 2026-09-08: disclosed
- 2026-09-08: patched: Fixed in Firefox for iOS 155.1

## References

- [https://bugzilla.mozilla.org/show_bug.cgi?id=1847631](https://bugzilla.mozilla.org/show_bug.cgi?id=1847631)
- [https://www.mozilla.org/security/advisories/mfsa2026-89/](https://www.mozilla.org/security/advisories/mfsa2026-89/)

## Related threats

- [Mozilla Firefox for iOS privilege escalation](https://junglewise.ai/threats/cve-2026-121843-privilege-escalation-in-firefox-for-ios-this-vulnerability-was)
- [Mozilla Firefox for iOS privilege escalation in Reader View](https://junglewise.ai/threats/cve-2026-121842-privilege-escalation-in-the-reader-view-component-in-firefox-for)
- [Firefox for iOS information disclosure](https://junglewise.ai/threats/cve-2026-121841-other-issue-in-firefox-for-ios-this-vulnerability-was-fixed-in)
- [Firefox for iOS FaceTime protocol handler spoofing](https://junglewise.ai/threats/cve-2026-116632-a-malicious-web-page-could-insert-arbitrary-text-into-the)
- [Firefox for iOS external protocol handler spoofing via tel link](https://junglewise.ai/threats/cve-2026-116631-a-malicious-web-page-could-open-a-tel-link-in-a-window-that-was)