CVE-2026-103418
Received Received - Intake

Firefox for iOS Translation JavaScript Code Execution

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: Mozilla Corporation

Description
Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in Firefox’s privileged content world and bypass the page’s Content Security Policy. This vulnerability was fixed in Firefox for iOS 157.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-103418
EUVD
EUVD-2026-98339

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mozilla firefox_for_ios 157.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Firefox for iOS had a flaw where it directly inserted the webpage's HTML language attribute into translation JavaScript. This allowed attackers to inject malicious markup that could execute code in Firefox's privileged environment, bypassing the page's Content Security Policy.

Detection Guidance

This vulnerability affects Firefox for iOS versions prior to 157.1. To detect it, check the installed version of Firefox for iOS on affected devices by opening the app and navigating to settings. If the version is below 157.1, the device is vulnerable.

Impact Analysis

If exploited, this vulnerability could allow attackers to run arbitrary code on your device through Firefox for iOS, potentially stealing data, installing malware, or monitoring your browsing activity. Users of vulnerable versions are at risk until updated.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations using vulnerable versions may face compliance violations.

Mitigation Strategies

Update Firefox for iOS to version 157.1 or later immediately. Disable automatic translation features if possible and avoid visiting untrusted websites until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103418. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart