CVE-2026-103418 Mozilla CVE debrief

Who should care

Defenders responsible for Firefox for iOS deployments should assess exposure and prioritize patching. This includes verifying exposure of Firefox for iOS versions prior to 157.1 and assessing the effectiveness of their Content Security Policy. Operators, platform administrators, vulnerability management teams, and security teams may be impacted.

Why it matters

CVE-2026-103418 is a Universal XSS vulnerability in Firefox for iOS Translation Services. Defenders should prioritize verifying exposure of Firefox for iOS versions prior to 157.1 and assess the effectiveness of their Content Security Policy.

• Potential code execution in Firefox's privileged content world
• Bypassing of Content Security Policy
• Verification of Firefox for iOS version and Content Security Policy effectiveness required

Technical summary

Firefox for iOS directly interpolated the page's HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in Firefox's privileged content world and bypass the page's Content Security Policy. This vulnerability was fixed in Firefox for iOS 157.1. The CVE record and Mozilla's advisory provide details on the vulnerability, but CVSS score and severity are not available. Defenders should prioritize verifying exposure of Firefox for iOS versions prior to 157.1 and assess the effectiveness of their Content Security Policy.

Defensive priority

Defenders should prioritize verifying exposure of Firefox for iOS versions prior to 157.1 and assess the effectiveness of their Content Security Policy.

Recommended defensive actions

• Verify Firefox for iOS version and update to 157.1 if necessary
• Assess Content Security Policy effectiveness
• Monitor for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and Mozilla's advisory provide details on the vulnerability. However, CVSS score and severity are not available. Defenders should verify exposure of Firefox for iOS versions prior to 157.1 and assess the effectiveness of their Content Security Policy. The vulnerability was fixed in Firefox for iOS 157.1. There is no information on known or unknown affected scope.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.