PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-116632 Mozilla CVE debrief

A vulnerability in Firefox for iOS could allow a malicious web page to insert arbitrary text into the FaceTime call prompt, potentially displaying a phishing message inside system UI. This issue was fixed in Firefox for iOS 156.1. The vulnerability could impact defenders managing Firefox for iOS installations, particularly in environments where phishing attacks are a concern. They should assess exposure and prioritize patching to prevent potential phishing attacks. The CVE record and related sources provide details about the vulnerability, but additional information about potential exploitation or impact is limited.

Vendor
Mozilla
Product
Firefox for iOS
CVSS
MEDIUM 5.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-26
Original CVE updated
2026-10-27
Advisory published
2026-10-26
Advisory updated
2026-10-27

Who should care

Defenders responsible for managing Firefox for iOS installations, particularly those in environments where phishing attacks are a concern, should assess exposure and prioritize patching.

Why it matters

A vulnerability in Firefox for iOS could allow a malicious web page to insert arbitrary text into the FaceTime call prompt, potentially displaying a phishing message inside system UI. Defenders should prioritize verifying the vulnerability status of Firefox for iOS installations and ensure that the patched version, 156.1, is deployed.

  • Defenders need to verify Firefox for iOS installations to prevent potential phishing attacks.
  • Phishing messages could be displayed inside system UI, potentially leading to user deception.

Technical summary

A malicious web page could insert arbitrary text into the FaceTime call prompt shown by iOS, potentially allowing it to display a phishing message inside system UI. This vulnerability was fixed in Firefox for iOS 156.1. The issue highlights the importance of keeping software up-to-date to prevent potential phishing attacks. Defenders should prioritize verifying the vulnerability status of Firefox for iOS installations and ensure that the patched version is deployed.

Defensive priority

Defenders should prioritize verifying the vulnerability status of Firefox for iOS installations and ensure that the patched version, 156.1, is deployed.

Recommended defensive actions

  • Verify Firefox for iOS installations to ensure the patched version, 156.1, is deployed.
  • Monitor for potential phishing attempts that could leverage this vulnerability.
  • Review system UI for suspicious activity related to FaceTime call prompts.

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, but additional information about potential exploitation or impact is limited. Defenders should verify Firefox for iOS installations to ensure the patched version, 156.1, is deployed and monitor for potential phishing attempts that could leverage this vulnerability. Review system UI for suspicious activity related to FaceTime call prompts. The vulnerability was fixed in Firefox for iOS 156.1, and defenders should be

Sources and references

Verified primary and authoritative sources

  • CVE-2026-116632 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-116632

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-116632 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-116632

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.