CVE-2026-8706
Firefox for iOS Reader Mode Local Server URL Request Vulnerability
Publication date: 2026-05-19
Last updated on: 2026-05-20
Assigner: Mozilla Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mozilla | firefox | to 151.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability in Firefox for iOS allowed another application on the same device to request arbitrary URLs and receive responses rendered with the signed-in user's cookies. This could lead to unauthorized access to user data associated with those cookies.
Such unauthorized access to personal data could potentially violate privacy regulations like GDPR or HIPAA, which require protection of user data and prevention of unauthorized data disclosure.
However, the provided information does not explicitly state the impact on compliance with these standards.
Can you explain this vulnerability to me?
This vulnerability existed in Firefox for iOS where the Reader mode was hosted on an unauthenticated local web server. This setup allowed another application on the same device to request arbitrary URLs through this local server.
Because the local server rendered responses using the signed-in user's cookies, the other application could receive responses as if it were the signed-in user, potentially accessing private or sensitive information.
This issue was fixed in Firefox for iOS version 151.0.
How can this vulnerability impact me? :
An attacker could exploit this vulnerability by using another application on the same iOS device to make arbitrary web requests through Firefox's Reader mode local server.
Because the responses are rendered with the signed-in user's cookies, the attacker could gain unauthorized access to private data or perform actions on behalf of the user without their consent.
This could lead to privacy breaches, data leakage, or unauthorized operations within web services where the user is authenticated.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should update Firefox for iOS to version 151.0 or later, where the issue has been fixed.