CVE-2026-8706

Description

Firefox for iOS hosted Reader mode on an unauthenticated local web server, allowing another application on the same device to request arbitrary URLs and receive the response rendered with the signed-in user's cookies. This vulnerability was fixed in Firefox for iOS 151.0.

PUBLISHED Reserved 2026-05-15 | Published 2026-05-19 | Updated 2026-05-19 | Assigner mozilla

Product status

Credits

Muneaki Nishimura

References

bugzilla.mozilla.org/show_bug.cgi?id=2036618

www.mozilla.org/security/advisories/mfsa2026-49/

cve.org (CVE-2026-8706)

nvd.nist.gov (CVE-2026-8706)

Download JSON