PT-2026-45411 · Mozilla · Firefox For Ios

Muneaki Nishimura · Published 2026-06-01 · Updated 2026-06-01 · CVE-2026-9309

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Firefox for iOS versions prior to 151.2

Description Reader View fails to properly escape HTML tags within JSON-LD metadata. This allows a malicious page to inject markup that alters Reader View behavior and leaks sensitive URL parameters. Such leaked parameters could be utilized to access internal pages, which may lead to arbitrary JavaScript execution within an internal origin.

Recommendations Update to version 151.2.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-9309

Affected Products

Firefox For Ios

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-9309 · Security Note
• https://mozilla.org/security/advisories/mfsa2026-53 · Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=2036573 · Note
• https://twitter.com/VulmonFeeds/status/2061444716529328436 · Twitter Post
• https://t.me/CVEtracker/55492 · Telegram Post