CVE-2026-14906

MEDIUM5.3Remote code exec

Description

Pages with malicious titles could potentially allow saved PDF content to overwrite PDF files or bundled content within the Firefox for iOS application sandbox. This vulnerability was fixed in Firefox for iOS 152.4.

CVSS breakdown

CVSS 3.1

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected products

Mozilla / Firefox for iOS152.4 – *
Mozilla / firefox_mobile152.4

References

MISChttps://bugzilla.mozilla.org/show_bug.cgi?id=2045842
VENDOR_ADVISORYhttps://www.mozilla.org/security/advisories/mfsa2026-66/

Updated 35m ago · 8 sources