Quick answers
- Is CVE-2026-9308 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-9308 being exploited in the wild.
- How severe is CVE-2026-9308?
- Informational severity, published 1 June 2026.
- Which products and versions are affected?
- Mozilla Firefox for iOS Before 151.2.
- Is there a fix for CVE-2026-9308?
- A patch was published on 2026-06-01: Fixed in Firefox for iOS 151.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-9308 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-9308?
- Check whether you run Mozilla Firefox for iOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A vulnerability exists in Firefox for iOS Reader View where page content was replaced in the HTML template before other internal placeholders were processed. This logic error allows a malicious page to include a specific placeholder string that is subsequently substituted with JSON-LD data during the rendering process. By manipulating this substitution order, an attacker can inject and execute arbitrary JavaScript within the context of the Reader View. This issue is fixed in Firefox for iOS version 151.2.
Affected products
- Mozilla Firefox for iOS Before 151.2
Timeline
- 2026-06-01: advisory: Mozilla Foundation Security Advisory 2026-53 published.
- 2026-06-01: patched: Fixed in Firefox for iOS 151.2.