# CVE-2026-9309: Mozilla Firefox for iOS HTML injection in Reader View JSON-LD metadata

Source: https://junglewise.ai/threats/cve-2026-9309-mozilla-firefox-for-ios-html-injection-in-reader-view-json-ld  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-01. Updated: 2026-06-01  
License: CC BY 4.0 with a link back

CVE-2026-9309 · Severity: info · CVSS 8.8 · Published 2026-06-01

A vulnerability in the Firefox for iOS 'Reader View' feature could allow a malicious website to execute unauthorized code on a user's device. By tricking the browser into misinterpreting website metadata, an attacker could steal sensitive information from the web address or gain access to internal browser pages. This could lead to the theft of user data or the compromise of the browser's security boundaries.

Technologies: [Mozilla Firefox for iOS](https://junglewise.ai/threats/technologies/firefox-for-ios). Vendors: [Mozilla](https://junglewise.ai/threats/vendors/mozilla).

## Quick answers

**Is CVE-2026-9309 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9309 being exploited in the wild.

**How severe is CVE-2026-9309?** Informational severity, with a CVSS score of 8.8, published 1 June 2026.

**Which products and versions are affected?** Mozilla Firefox for iOS Before 151.2.

**Is there a fix for CVE-2026-9309?** A patch was published on 2026-06-01: Fixed in Firefox for iOS 151.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-9309 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-9309?** Check whether you run Mozilla Firefox for iOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in Firefox for iOS Reader View due to improper neutralization of input during web page transformation. The application fails to escape HTML tags within JSON-LD metadata, allowing a malicious page to inject arbitrary markup. This injection can be used to alter Reader View behavior and leak sensitive URL parameters. An attacker can leverage these leaked parameters to target internal browser pages, ultimately achieving arbitrary JavaScript execution within an internal origin. The issue is resolved in version 151.2.

## Affected products

- Mozilla Firefox for iOS Before 151.2

## Timeline

- 2026-06-01: disclosed
- 2026-06-01: advisory
- 2026-06-01: patched: Fixed in Firefox for iOS 151.2

## References

- [https://bugzilla.mozilla.org/show_bug.cgi?id=2036573](https://bugzilla.mozilla.org/show_bug.cgi?id=2036573)
- [https://www.mozilla.org/security/advisories/mfsa2026-53/](https://www.mozilla.org/security/advisories/mfsa2026-53/)

## Related threats

- [Mozilla Firefox for iOS privilege escalation](https://junglewise.ai/threats/cve-2026-121843-privilege-escalation-in-firefox-for-ios-this-vulnerability-was)
- [Mozilla Firefox for iOS privilege escalation in Reader View](https://junglewise.ai/threats/cve-2026-121842-privilege-escalation-in-the-reader-view-component-in-firefox-for)
- [Firefox for iOS information disclosure](https://junglewise.ai/threats/cve-2026-121841-other-issue-in-firefox-for-ios-this-vulnerability-was-fixed-in)
- [Firefox for iOS FaceTime protocol handler spoofing](https://junglewise.ai/threats/cve-2026-116632-a-malicious-web-page-could-insert-arbitrary-text-into-the)
- [Firefox for iOS external protocol handler spoofing via tel link](https://junglewise.ai/threats/cve-2026-116631-a-malicious-web-page-could-open-a-tel-link-in-a-window-that-was)