This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Mozilla Firefox for iOS fixes 2 vulnerabilities
Mozilla fixes 2 vulnerabilities in Firefox for iOS with version 151.2 [1].
An unauthenticated remote attacker can, due to an incorrect order of replacing content and internal placeholder strings in the HTML template of the Reader View feature, execute arbitrary JavaScript code after a malicious page is opened [1].
The vulnerability is present in product:
- Firefox (iOS); <151.2
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
More information:
- CVE-2026-9308 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org
The vulnerability was publicly disclosed 1. 6. 2026.
An unauthenticated remote attacker can, due to insufficient escaping of HTML tags in the JSON-LD metadata of the Reader View feature, obtain sensitive URL parameters and potentially execute arbitrary JavaScript code [1].
The vulnerability is present in product:
- Firefox (iOS); <151.2
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
More information:
- CVE-2026-9309 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org
The vulnerability was publicly disclosed 1. 6. 2026.
By CESNET, z.s.p.o. Michaela Jarošová on 3. 6. 2026.