Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2026-103418: Firefox for iOS may execute malicious code via translation
CVE-2026-103418 · published 22 days ago
Summary
Firefox for iOS could let a crafted web page insert hidden code when its translation feature runs. That code runs with elevated rights, bypassing normal security protections and could expose or alter data. Install the latest update (version 157.1 or later) to fix the issue.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| mozilla | firefox for ios | All versions |
Original advisory text
Universal XSS via the HTML language attribute in Translation Services
Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in Firefox’s privileged content world and bypass the page’s Content Security Policy. This vulnerability was fixed in Firefox for iOS 157.1.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
8.8
High
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published13 Oct 2026
Updated4 Nov 2026
First seen13 Oct 2026
Track software like this
Free during beta