PT-2026-49701 · Mozilla · Firefox For Ios

Muneaki Nishimura · Published 2026-06-16 · Updated 2026-06-16 · CVE-2026-53900

NVD

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Firefox for iOS preserved cookies set on the initial PDF request across cross-origin HTTP redirects in TemporaryDocument, allowing a malicious site to inject arbitrary cookies into requests to an unrelated target domain. This vulnerability was fixed in Firefox for iOS 152.0.

Fix

Insufficient Verification of Data Authenticity

Session Fixation

Weakness Enumeration

CWE-345

CWE-384

Related Identifiers

CVE-2026-53900

Affected Products

Firefox For Ios

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-53900 · Security Note
• https://mozilla.org/security/advisories/mfsa2026-56 · Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=2043204 · Note