# Mozilla Firefox for iOS vulnerabilities Source: https://junglewise.ai/threats/technologies/firefox-for-ios Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/firefox-for-ios.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 17 vulnerabilities in Mozilla Firefox for iOS: 3 in the last 7 days and 9 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-121843, was published on 9 November 2026. 4 vulnerabilities in the last four weeks, up from none in the four before. ## Counts - Last 7 days: 3 - Last 30 days: 5 - Last 90 days: 9 - All time: 17 (0 critical, 0 exploited in the wild) ## About Mozilla Firefox for iOS A mobile web browser developed by Mozilla for the iOS operating system. ## Latest Mozilla Firefox for iOS vulnerabilities - [CVE-2026-121843: Mozilla Firefox for iOS privilege escalation](https://junglewise.ai/threats/cve-2026-121843-privilege-escalation-in-firefox-for-ios-this-vulnerability-was) (info, published 9 Nov 2026) - [CVE-2026-121842: Mozilla Firefox for iOS privilege escalation in Reader View](https://junglewise.ai/threats/cve-2026-121842-privilege-escalation-in-the-reader-view-component-in-firefox-for) (info, published 9 Nov 2026) - [CVE-2026-121841: Firefox for iOS information disclosure](https://junglewise.ai/threats/cve-2026-121841-other-issue-in-firefox-for-ios-this-vulnerability-was-fixed-in) (info, published 9 Nov 2026) - [CVE-2026-116632: Firefox for iOS FaceTime protocol handler spoofing](https://junglewise.ai/threats/cve-2026-116632-a-malicious-web-page-could-insert-arbitrary-text-into-the) (medium, CVSS 5.4, published 26 Oct 2026) - [CVE-2026-116631: Firefox for iOS external protocol handler spoofing via tel link](https://junglewise.ai/threats/cve-2026-116631-a-malicious-web-page-could-open-a-tel-link-in-a-window-that-was) (medium, CVSS 5.4, published 26 Oct 2026) - [CVE-2026-103418: Firefox for iOS XSS via HTML language attribute in Translation Services](https://junglewise.ai/threats/cve-2026-103418-firefox-for-ios-directly-interpolated-the-page-s-html-language) (high, CVSS 8.8, published 13 Oct 2026) - [CVE-2026-103417: Firefox for iOS credential autofill after cross-origin navigation](https://junglewise.ai/threats/cve-2026-103417-firefox-for-ios-could-autofill-saved-credentials-into-a-new-page) (medium, CVSS 5.5, published 13 Oct 2026) - [CVE-2026-86853: Mozilla Firefox for iOS denial of service via URL schemes](https://junglewise.ai/threats/cve-2026-86853-mozilla-firefox-for-ios-denial-of-service-via-url-schemes) (medium, CVSS 4.3, published 8 Sep 2026) - [CVE-2026-81267: Mozilla Firefox for iOS address bar spoofing in popup navigation](https://junglewise.ai/threats/cve-2026-81267-mozilla-firefox-for-ios-address-bar-spoofing-in-popup-navigation) (medium, CVSS 5.4, published 31 Aug 2026) - [CVE-2026-14906: Mozilla Firefox for iOS sandbox file overwrite via malicious page titles](https://junglewise.ai/threats/cve-2026-14906-mozilla-firefox-for-ios-sandbox-file-overwrite-via-malicious-page) (info, CVSS 0, published 13 Jul 2026) - [CVE-2026-13356: Mozilla Firefox for iOS address bar origin spoofing](https://junglewise.ai/threats/cve-2026-13356-mozilla-firefox-for-ios-address-bar-origin-spoofing) (info, CVSS 0, published 7 Jul 2026) - [CVE-2026-53900: Mozilla Firefox for iOS cookie injection via PDF redirect](https://junglewise.ai/threats/cve-2026-53900-mozilla-firefox-for-ios-cookie-injection-via-pdf-redirect) (info, CVSS 7.5, published 16 Jun 2026) - [CVE-2026-53899: Mozilla Firefox for iOS cookie leakage in PDF requests](https://junglewise.ai/threats/cve-2026-53899-mozilla-firefox-for-ios-cookie-leakage-in-pdf-requests) (info, CVSS 7.5, published 16 Jun 2026) - [CVE-2026-9309: Mozilla Firefox for iOS HTML injection in Reader View JSON-LD metadata](https://junglewise.ai/threats/cve-2026-9309-mozilla-firefox-for-ios-html-injection-in-reader-view-json-ld) (info, CVSS 8.8, published 1 Jun 2026) - [CVE-2026-9308: Mozilla Firefox for iOS JavaScript execution in Reader View](https://junglewise.ai/threats/cve-2026-9308-mozilla-firefox-for-ios-javascript-execution-in-reader-view) (info, published 1 Jun 2026) - [CVE-2026-9078: Mozilla Firefox for iOS address spoofing in link preview](https://junglewise.ai/threats/cve-2026-9078-mozilla-firefox-for-ios-address-spoofing-in-link-preview) (info, published 25 May 2026) - [CVE-2026-8706: Mozilla Firefox for iOS data leak in Reader mode local web server](https://junglewise.ai/threats/cve-2026-8706-mozilla-firefox-for-ios-data-leak-in-reader-mode-local-web-server) (info, published 19 May 2026) ## Most severe Mozilla Firefox for iOS vulnerabilities - [CVE-2026-103418: Firefox for iOS XSS via HTML language attribute in Translation Services](https://junglewise.ai/threats/cve-2026-103418-firefox-for-ios-directly-interpolated-the-page-s-html-language) (high, CVSS 8.8, published 13 Oct 2026) - [CVE-2026-103417: Firefox for iOS credential autofill after cross-origin navigation](https://junglewise.ai/threats/cve-2026-103417-firefox-for-ios-could-autofill-saved-credentials-into-a-new-page) (medium, CVSS 5.5, published 13 Oct 2026) - [CVE-2026-81267: Mozilla Firefox for iOS address bar spoofing in popup navigation](https://junglewise.ai/threats/cve-2026-81267-mozilla-firefox-for-ios-address-bar-spoofing-in-popup-navigation) (medium, CVSS 5.4, published 31 Aug 2026) - [CVE-2026-116632: Firefox for iOS FaceTime protocol handler spoofing](https://junglewise.ai/threats/cve-2026-116632-a-malicious-web-page-could-insert-arbitrary-text-into-the) (medium, CVSS 5.4, published 26 Oct 2026) - [CVE-2026-116631: Firefox for iOS external protocol handler spoofing via tel link](https://junglewise.ai/threats/cve-2026-116631-a-malicious-web-page-could-open-a-tel-link-in-a-window-that-was) (medium, CVSS 5.4, published 26 Oct 2026) - [CVE-2026-86853: Mozilla Firefox for iOS denial of service via URL schemes](https://junglewise.ai/threats/cve-2026-86853-mozilla-firefox-for-ios-denial-of-service-via-url-schemes) (medium, CVSS 4.3, published 8 Sep 2026) - [CVE-2026-9309: Mozilla Firefox for iOS HTML injection in Reader View JSON-LD metadata](https://junglewise.ai/threats/cve-2026-9309-mozilla-firefox-for-ios-html-injection-in-reader-view-json-ld) (info, CVSS 8.8, published 1 Jun 2026) - [CVE-2026-53900: Mozilla Firefox for iOS cookie injection via PDF redirect](https://junglewise.ai/threats/cve-2026-53900-mozilla-firefox-for-ios-cookie-injection-via-pdf-redirect) (info, CVSS 7.5, published 16 Jun 2026) - [CVE-2026-53899: Mozilla Firefox for iOS cookie leakage in PDF requests](https://junglewise.ai/threats/cve-2026-53899-mozilla-firefox-for-ios-cookie-leakage-in-pdf-requests) (info, CVSS 7.5, published 16 Jun 2026) - [CVE-2026-14906: Mozilla Firefox for iOS sandbox file overwrite via malicious page titles](https://junglewise.ai/threats/cve-2026-14906-mozilla-firefox-for-ios-sandbox-file-overwrite-via-malicious-page) (info, CVSS 0, published 13 Jul 2026) ## Vulnerabilities per week 4 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 1 | 0 | 0 | | 7 Sep 2026 | 1 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 2 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 2 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 3 | 0 | 0 | ## Other Mozilla technologies - [Mozilla Firefox](https://junglewise.ai/threats/technologies/firefox): 869 vulnerabilities - [Mozilla Firefox ESR](https://junglewise.ai/threats/technologies/firefox-esr): 642 vulnerabilities - [Mozilla Thunderbird](https://junglewise.ai/threats/technologies/thunderbird): 396 vulnerabilities - [Mozilla Thunderbird-Esr](https://junglewise.ai/threats/technologies/thunderbird-esr): 86 vulnerabilities - [Mozilla Firefox for Android](https://junglewise.ai/threats/technologies/firefox-for-android): 11 vulnerabilities - [Mozilla Firefox Mobile](https://junglewise.ai/threats/technologies/firefox-mobile): 7 vulnerabilities - [Mozilla Firefox Focus](https://junglewise.ai/threats/technologies/firefox-focus-for-android): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Mozilla Firefox for iOS vulnerabilities", https://junglewise.ai/threats/technologies/firefox-for-ios, 13 November 2026.