PT-2026-49701 · Mozilla · Firefox For Ios

Muneaki Nishimura · CVE-2026-53900 · Published 2026-06-16 · Updated 2026-06-17

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Firefox for iOS versions prior to 152.0

Description Firefox for iOS preserved cookies set on the initial PDF request across cross-origin HTTP redirects in TemporaryDocument. This behavior allows a malicious site to inject arbitrary cookies into requests directed to an unrelated target domain.

Recommendations Update to version 152.0.

Fix

Insufficient Verification of Data Authenticity

Session Fixation

Weakness Enumeration

CWE-345

CWE-384

Related Identifiers

CVE-2026-53900

Affected Products

Firefox For Ios

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-53900 · Security Note
• https://mozilla.org/security/advisories/mfsa2026-56 · Vendor Advisory
• https://t.me/CVEtracker/56996 · Telegram Post
• https://bugzilla.mozilla.org/show_bug.cgi?id=2043204 · Note
• https://t.me/cveNotify/169511 · Telegram Post
• https://twitter.com/CVEnew/status/2066980920570384459 · Twitter Post